Russian Organized Crime Gangs Linked to Cyber Attacks on Georgia

The cyberattacks against Georgia a year ago were conducted in close connection with Russian criminal gangs, and the attackers likely were tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the U.S. Cyber Consequences Unit, an independent nonprofit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the U.S. government and some cybersecurity professionals, but the organization did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorized that the distributed denial-of-service attacks (DDOS), which crippled many Georgian Web sites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the U.S. Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new Web sites, were accomplished so quickly that all of the steps had to be prepared earlier."

Borg said that the institute is confident that the Russian government didn't directly carry out the attacks. But it is clear that Russia appeared to be leveraging civilian nationalists who were ready to take cyber action, perhaps with some low-level encouragement.

"It appears that the military invasion was taking into account the help they were about to receive ... by the cyberattack," Borg said.

It is not clear, however, at what level the interaction between Russian government officials and those who executed the attacks occurred. But it does appear that the loose coordination will likely become part of Russia's standard operating procedure from now on, Borg said.

A total of 54 Web sites were attacked, most of which would have benefited the Russian military campaign by not functioning, Borg said. By shutting down media and government sites, it was harder for Georgia to communicate to the public what was going on. Financial transactions were disrupted, and the National Bank of Georgia had to cut off its Internet connection for 10 days, according to the report.

Social networking sites helped recruit volunteers who traded tips on online forums in Russian, with one English-language forum hosted in San Francisco, the report said. Computers servers that had been used in the past to host malicious software by Russian criminal gangs were also used in the attacks.

"It appears that Russian criminal organizations made no effort to conceal their involvement in the cyber campaign against Georgia because they wanted to claim credit for it," the report said.

DDOS attacks work by bombarding a Web site with too many page requests, which causes it to become unavailable due to bandwidth problems unless security measures are taken. The attack is executed by a botnet, or a network of PCs that become infected with malicious code controlled by a hacker.

The code used to command those machines to attack the Web sites appeared to be customized specifically for the Georgia campaign, the report said. Three of the software programs used were designed to test Web sites to see how much traffic they can handle.

A fourth program was originally designed to add functions to Web sites but was altered by the hackers to request nonexistent Web pages. That tool, which is HTTP-based, proved more efficient than the ICMP-based (Internet Control Message Protocol) attacks used against Estonia in 2007, the report said.

Further evidence showed that Georgia could have been hit much harder. Some of Georgia's critical infrastructure was accessible over the Internet. While the civilian cyber attackers had signs of considerable expertise, "if the Russian military had chosen to get directly involved, such attacks would have been well within their capabilities," the report said.

"The fact that physically destructive cyberattacks were not carried out against Georgian critical infrastructure industries suggests that someone on the Russian side was exercising considerable constraint," it said.

Thanks to Jeremy Kirk