×

‘Fancy Bear’ hackers took aim at US defense contractors

  • This combination of photos shows an Air Force F-22 Raptor stealth fighter jet, left, an MQ-9 Reaper/“Predator B” drone, right, and an X-37B unmanned spacecraft, bottom. U.S. Air Force via AP

  • Keven Gambold, CEO of Unmanned Experts, demonstrates how to fly a drone at the Searchlight airport in Searchlight, Nev., on Wednesday, Jan. 17, 2018. Gambold, a hacking target, said the Russians might be counting on espionage to catch up with the Americans. “This would allow them to leapfrog years of hard-won experience,” he said. (AP Photo/Isaac Brekken) Isaac Brekken

  • Jessica Balik, left, and Keven Gambold, right, CEO of Unmanned Experts, prepare a drone for a demonstration at the Searchlight airport in Searchlight, Nev., on Wednesday, Jan. 17, 2018. Gambold, a hacking target, said his own company is so worried about hacking that “we’ve almost gone back in time to use stand-alone systems if we’re processing client proprietary data _ we’re FedEx'ing hard drives around.” (AP Photo/Isaac Brekken) Isaac Brekken

  • Retired Air Force Maj. Gen. James Poss, speaks about a hacking attempt on him, and the danger of such attacks in general, in his home office in Ocean Springs, Miss., on Jan. 17, 2018. An expert with three decades of experience in the military, Poss now consults on drones and intelligence. (AP Photo/Rogelio V. Solis) Rogelio V. Solis

  • Retired Air Force Maj. Gen. James Poss, speaks in his home office in Ocean Springs, Miss., on Jan. 17, 2018. Poss, whose Gmail was nearly compromised in a phishing attempt, said that military spying is now far easier than when somebody needed to carry blueprints or photographs out of office buildings. “You’d need maybe 2,000 spies to do in the real world what a small group of cyberspies can do,” he says. (AP Photo/Rogelio V. Solis) Rogelio V. Solis

  • FILE - In this Monday, Jan. 11, 2016 file photo, Russian Deputy Prime Minister Dmitry Rogozin holds a model of an S-300 surface-to-air missile system at a news conference in Belgrade, Serbia. In May 2015, Rogozin invoked the X-37B unmanned space plane as evidence that his country’s space program was faltering. “The United States is pushing ahead,” he warned Russian lawmakers. Less than two weeks later, the hacking group Fancy Bear tried to penetrate the Gmail account of a senior engineer on the X-37B project at Boeing. (Marina Lopicic/Kurir via AP) Marina Lopicic



Associated Press
Wednesday, February 07, 2018

WASHINGTON — Russian hackers exploited a key vulnerability in U.S. cyber defenses to come within reach of stealing some of the nation’s most secret and advanced defense technology, an Associated Press investigation has found.

What may have been stolen is uncertain, but the cyberspies clearly took advantage of poorly protected email and scant direct notification of victims.

The hackers known as Fancy Bear, who also intruded in the U.S. election, went after at least 87 people working on military drones, missiles, rockets, stealth fighter jets, cloud-computing platforms, or other sensitive activities, the AP found. Thirty-one agreed to interviews.

Employees at both small companies and defense giants like Lockheed Martin Corp., Raytheon Co., Boeing Co., Airbus Group and General Atomics were targeted. Contacted by the AP, those companies offered no comment.

“The programs that they appear to target and the people who work on those programs are some of the most forward-leaning, advanced technologies,” said Charles Sowell, a former senior adviser in the Office of the U.S. Director of National Intelligence, who reviewed the list of names for the AP. “And if those programs are compromised in any way, then our competitive advantage and our defense is compromised.”

“That’s what’s really scary,” added Sowell, who was himself one of the hacking targets.

The AP identified Fancy Bear’s prey from about 19,000 lines of the hackers’ email phishing data collected by the U.S.-based cybersecurity company Secureworks, which calls the hackers Iron Twilight. The data is partial and extends from March 2015 to May 2016.

Most of the people on the target list worked on classified projects. Yet as many as 40 percent clicked on the hackers’ phishing links, the AP analysis indicates. That’s the first step in potentially opening their accounts or computer files to digital theft.

Hackers predominantly targeted personal Gmail, with a few corporate accounts mixed in. Personal accounts can convey classified information — whether through carelessness or expediency — and lead to more valuable targets or carry embarrassing personal details that can be used for blackmail or to recruit spies.

Among their interests, the Russians seemed to be eyeing the X-37B, an American unmanned space plane that looks like a miniature shuttle.

Referring to an X-37B flight in May 2015, Russian Deputy Prime Minister Dmitry Rogozin invoked it as evidence that his country’s space program was faltering. “The United States is pushing ahead,” he warned Russian lawmakers.

Less than two weeks later, Fancy Bear tried to penetrate the Gmail account of a senior engineer on the X-37B project at Boeing.

The hackers also chased people who work on cloud-based services, the off-site computer networks that enable collaborators to work with data that is sometimes classified. For example, the cyberspies tried to get into the Gmail of an employee at Mellanox Federal Systems, which helps the government with high-speed storage networks, data analysis and cloud computing. Its clients include the FBI and other intelligence agencies.

Yet of the 31 targets reached by AP, just one got any warning from U.S. officials.

The FBI declined to give on-the-record details of its response to this Russian operation. Agency spokeswoman Jillian Stickels said the FBI does sometimes notify individual targets. “The FBI takes ... all potential threats to public and private sector systems very seriously,” she said.

However, three people familiar with the matter — including a current and a former government official — previously told the AP the FBI knew the details of Fancy Bear’s phishing campaign for more than a year.

Pressed about notification in that case, a senior FBI official, who was not authorized to publicly discuss the hacking operation because of its sensitivity, said the bureau was overwhelmed by the sheer number of attempted hacks. “It’s a matter of triaging to the best of our ability the volume of the targets who are out there,” he said.