Bi-Partisan Senate report calls for sweeping effort to stop Russian trolls on social media platforms.

Choco8 said:

The creative minds at Daily Kos have a Final Solution in mind. Not sure if internment camps are next. They are also very worried about Russian Anchor Babies, which is NOTHING LIKE conservatives being afraid of Mexican Anchor Babies. Some irrational xenophobias are better than others.

Click to expand...

hanimmal said:

Who is Daily Kos, and why should we care if what you say is true or not about them?

Click to expand...

Russia Recalls Ambassador For Talks After Biden Says Putin Will Pay For Election Meddling (Update)

The Russian government has recalled its ambassador to Washington for consultations in Moscow after President Joe Biden said Vladimir Putin would “pay a price” for meddling in the 2020 election. The announcement...

www.dailykos.com

Choco8 said:

Daily Kos is a site dedicated to sheep-herding liberals into supporting establishment Democrats, which unfortunately includes infusing them with a great deal of propaganda and fear-mongering about Russia, which I think is a dangerous development, You can read the post I screenshotted here:

Russia Recalls Ambassador For Talks After Biden Says Putin Will Pay For Election Meddling (Update)

The Russian government has recalled its ambassador to Washington for consultations in Moscow after President Joe Biden said Vladimir Putin would “pay a price” for meddling in the 2020 election. The announcement...

www.dailykos.com

Why should you care? I would say you should care if you think the idea of expelling thousands of Russian citizens from the USA is disgusting.

But maybe you think it's a good idea. Maybe you think Russian citizens are actually dangerous. I really don't know.

Click to expand...

Choco8 said:

Daily Kos is a site dedicated to sheep-herding liberals into supporting establishment Democrats, which unfortunately includes infusing them with a great deal of propaganda and fear-mongering about Russia, which I think is a dangerous development, You can read the post I screenshotted here:

Russia Recalls Ambassador For Talks After Biden Says Putin Will Pay For Election Meddling (Update)

The Russian government has recalled its ambassador to Washington for consultations in Moscow after President Joe Biden said Vladimir Putin would “pay a price” for meddling in the 2020 election. The announcement...

www.dailykos.com

Why should you care? I would say you should care if you think the idea of expelling thousands of Russian citizens from the USA is disgusting.

But maybe you think it's a good idea. Maybe you think Russian citizens are actually dangerous. I really don't know.

Click to expand...

The Biden administration on Thursday imposed the first significant sanctions targeting the Russian economy in several years in order to punish the Kremlin for a cyberespionage campaign against the United States and efforts to influence the presidential election, according to senior U.S. officials.

The administration also sanctioned six Russian companiesthat support Russian spy services’ cyberhacking operations and will expel 10 intelligence officers working under diplomatic cover in the United States.
The measures are an effort to make good on President Biden’s vow to hold Moscow accountable for a series of operations, including the hacking operation commonly known as SolarWinds, which compromised nine federal agencies and about 100 private firms.

“Our view is that no single action that we will take or could take in and of itself could directly alter Russia’s malign behavior,” principal deputy national security adviser Jonathan Finer said. “But this is going to be a process that is going to take place over time, and it will involve a mix of significant pressure and finding ways to work together.”

The announcement of a U.S. response had been repeatedly pushed back, in part because Biden has wanted his team to develop more effective measures, said senior administration officials, who spoke on the condition of anonymity to discuss a sensitive matter.

Biden told Russian President Vladimir Putin in a call on Tuesday that Washington would be taking actions “in the coming days” to defend U.S. national interests, without specifying the exact timing or measures, a senior administration official said. Biden also raised the possibility of a summit with Putin.

As president-elect, Biden had told Putin in January that his administration would be “compelled to respond” to these activities, the official said. “So it should not come as a surprise to the government of Russia that we’re taking these actions.”

Biden administration planning to sanction Russia for SolarWinds hacks

The package includes sanctions on all debt Russia issues after June 14, barring U.S. financial institutions from buying government bonds directly from the Russian Central Bank, Russian National Wealth Fund and the Ministry of Finance. The action, experts said, will complicate Moscow’s ability to raise money in the international capital markets.

Under a new order signed by Biden, the administration is reserving the right to broaden the scope of the sovereign debt sanctions if Moscow’s malign activities persist, officials said.

“This action signals that the Biden administration is not going to hold back,” said Edward Fishman, a nonresident senior fellow at the Atlantic Council. “They’re taking significant actions against the Russian economy and putting global markets on notice that Russian sanctions will increase if Russia’s aggressive behavior continues.”

Many commentators have observed that sanctions to date have not materially affected the Kremlin’s risk calculus, and they say that more sanctions are unlikely to do so.

Kremlin spokesman Dmitry Peskov said Thursday that Russia viewed any U.S. sanctions as illegal and would retaliate in kind.

Peskov said sanctions would not be helpful in the lead-up to a proposed summit between Biden and Putin.

“We condemn any sanction aspirations. We believe they are illegal. In any case, the principle of reciprocity applies in this case. Reciprocity will meet our interests in the best possible way,” Peskov said.

European allies and NATO are expected to issue statements of support following the White House’s announcement, though they are not planning to impose fresh sanctions of their own, officials said.

The measures will be accompanied by what the White House hopes will be a strong message to Moscow to convey U.S. displeasure, but without cutting off diplomacy, said a second official. The message, the official said, is: “We are willing to talk about certain things, but we can’t have a strong relationship while you continue to take these malign steps.”

One action that will not be tied to the sanctions is Russia’s reported effort to put bounties on the heads of U.S. troops in Afghanistan in 2019, officials said. U.S. intelligence agencies had low to moderate confidence that officers with the Russian military spy agency, the GRU, sought to encourage Taliban attacks against U.S. and coalition personnel — not strong enough to justify the imposition of sanctions, officials said.

“But we do believe that this information puts the burden on the Russian government to explain its action and takes steps to address this disturbing pattern of behavior,” the senior administration official said. “We expressed those concerns directly to the government of Russia.”

The new executive order focuses on Russian activities outside its borders and “is intended to signal to the Russian government that its destabilizing behavior is unacceptable and that the United States will impose economically impactful costs if it continues or escalates,” the senior official said.

On Ukraine’s doorstep, Russia boosts military and sends message of regional clout to Biden

The executive order is sweeping, covering a range of actions that can be sanctioned, from cyberattacks to election interference to transnational corruption. Creating such an umbrella order streamlines the messaging, allowing the administration to sanction one state — Russia — for a diverse set of activities under one authority, experts said.

“It’s good to clearly message our priorities to Russia,” said Andrea Kendall-Taylor, a senior fellow at the Center for a New American Security. “By packaging a response to several things at once, the administration can get off the back foot and move on its agenda. What we don’t want is to always be in response mode to Russia.”

The sanctions and expulsions come four months after revelations that Russian cyberspies had compromised major federal agencies, including the Treasury and State departments and a number of private-sector companies. The hacks were enabled by corrupted software updates from the Texas-based company SolarWinds. The Washington Post first reported that the Russian foreign intelligence service SVR was believed to be behind the intrusions. The SolarWinds link was first disclosed by a private cyber firm, FireEye.

The White House officially named the SVR, also known by the moniker Cozy Bear, as the perpetrator behind the spy campaign. The intelligence community has high confidence in that assessment, officials said.

Biden’s repeated vows to punish the party responsible raised expectations the administration would take action — despite the fact that the intrusions apparently fell into the category of political espionage. All countries engage in such espionage.

But senior administration officials have said that Russia’s presence in federal networks could give it a toehold to undertake more disruptive actions. And some policy experts have said that should be grounds for punishment. Others disagreed, saying the operation did not reach disruptive levels.

Click to expand...

BOSTON (AP) — A global epidemic of digital extortion known as ransomware is crippling local governments, hospitals, school districts and businesses by scrambling their data files until they pay up. Law enforcement has been largely powerless to stop it.

One big reason: Ransomware rackets are dominated by Russian-speaking cybercriminals who are shielded — and sometimes employed — by Russian intelligence agencies, according to security researchers, U.S. law enforcement, and now the Biden administration.

On Thursday, as the U.S. slapped sanctions on Russia for malign activities including state-backed hacking, the Treasury Department said Russian intelligence has enabled ransomware attacks by cultivating and co-opting criminal hackers and giving them safe harbor. With ransomware damages now well into the tens of billions of dollars, former British intelligence cyber chief Marcus Willett recently deemed the scourge“arguably more strategically damaging than state cyber-spying.”

The value of Kremlin protection isn’t lost on the cybercriminals themselves. Earlier this year, a Russian-language dark-web forum lit up with criticism of a ransomware purveyor known only as “Bugatti,” whose gang had been caught in a rare U.S.-Europol sting. The assembled posters accused him of inviting the crackdown with technical sloppiness and by recruiting non-Russian affiliates who might be snitches or undercover cops.

Worst of all, in the view of one long-active forum member, Bugatti had allowed Western authorities to seize ransomware servers that could have been sheltered in Russia instead. “Mother Russia will help,” that individual wrote. “Love your country and nothing will happen to you.” The conversation was captured by the security firm Advanced Intelligence, which shared it with the Associated Press.

“Like almost any major industry in Russia, (cybercriminals) work kind of with the tacit consent and sometimes explicit consent of the security services,” said Michael van Landingham, a former CIA analyst who runs the consultancy Active Measures LLC.

Russian authorities have a simple rule, said Karen Kazaryan, CEO of the software industry-supported Internet Research Institute in Moscow: “Just don’t ever work against your country and businesses in this country. If you steal something from Americans, that’s fine.”

Unlike North Korea, there is no indication Russia’s government benefits directly from ransomware crime, although Russian President Vladimir Putin may consider the resulting havoc a strategic bonus.

In the U.S. alone last year, ransomware struck more than a hundred federal, state and municipal agencies, upward of 500 hospitals and other health care centers, some 1,680 schools, colleges and universities and hundreds of businesses, according to t he cybersecurity firm Emsisoft.

Damage in the public sector alone is measured in rerouted ambulances, postponed cancer treatments, interrupted municipal bill collection, canceled classesand rising insurance costs – all during the worst public health crisis in more than a century.



That’s what happened in a 2014 hack of Yahoo that compromised more than 500 million user accounts, allegedly including those of Russian journalists and U.S. and Russian government officials. A U.S. investigation led to the 2017 indictment of four men, including two officers of Russia’s FSB security service– a successor to the KGB. One of them, Dmitry Dokuchaev, worked in the same FSB office that cooperates with the FBI on computer crime. Another defendant, Alexsey Belan, allegedly used the hack for personal gain.

A Russian Embassy spokesman declined to address questions about his government’s alleged ties to ransomware criminals and state employees’ alleged involvement in cybercrime. “We do not comment on any indictments or rumors,” said Anton Azizov, the deputy press attache in Washington.

Proving links between the Russian state and ransomware gangs is not easy. The criminals hide behind pseudonyms and periodically change the names of their malware strains to confuse Western law enforcement.

But at least one ransomware purveyor has been linked to the Kremlin. Maksim Yakubets, 33, is best known as co-leader of a cybergang that cockily calls itself Evil Corp. The Ukraine-born Yakubets lives a flashy lifestyle, He drives a customized Lamborghini supercar with a personalized number plate that translates to ‘Thief,’ according to Britain’s National Crime Agency.

Yakubets started working for the FSB in 2017, tasked with projects including “acquiring confidential documents through cyber-enabled means and conducting cyber-enabled operations on its behalf,” according to a December 2019 U.S. indictment. At the same time, the U.S. Treasury Department slapped sanctions on Yakubets and offered a $5 million reward for information leading to his capture. It said he was known to have been “in the process of obtaining a license to work with Russian classified information from the FSB.”

The indictment charged Evil Corp. with developing and distributing ransomware used to steal at least $100 million in more than 40 countries over the previous decade, including payrolls pilfered from towns in the American heartland.

By the time Yakubets was indicted, Evil Corp. had become a major ransomware player, security researchers say. By May 2020, the gang was distributing a ransomware strain that was used to attack eight Fortune 500 companies, including the GPS device maker Garmin, whose network was offline for days after an attack, according to Advanced Intelligence.

Yakubets remains at large. Another Russian currently imprisoned in France, however, might offer more insight into the dealings of cybercriminals and the Russian state. Alexander Vinnick was convicted of laundering $160 million in criminal proceeds through a cryptocurrency exchange called BTC-e. A 2017 U.S. indictment charged that “some of the largest known purveyors of ransomware” actually used it to launder $4 billion. But Vinnick can’t be extradited until he completes his 5-year French prison sentence in 2024.

Still, a 2018 study by the nonpartisan think tank Third Way found the odds of successfully prosecuting authors of cyberattacks against U.S. targets — ransomware and online bank theft are the costliest — are no better than three in a thousand. Experts say that those odds have gotten longer.

This week’s sanctions send a strong message, but aren’t likely to deter Putin unless the financial sting hits closer to home, many analysts believe.

That might require the kind of massive multinational coordination that followed the 9/11 terror attacks. For instance, allied countries could identify banking institutions known to launder ransomware proceeds and cut them off from the global financial community.

“If you’re able to follow the money and disrupt the money and take the economic incentive out, that’ll go a long way in stopping ransomware attacks,” said John Riggi, cybersecurity advisor for the American Hospital Association and a former FBI official.

Click to expand...

hanimmal said:

https://apnews.com/article/intelligence-agencies-epidemics-local-governments-hacking-russia-c9dab7eb3841be45dff2d93ed3102999
View attachment 4880188

Click to expand...

A Facebook report released Wednesday says that Russia is still the largest producer of disinformation, a notable finding just five years after Russian operatives launched a far-reaching campaign to infiltrate social media during the 2016 presidential election campaign.

Facebook says it has uncovered disinformation campaigns in more than 50 countries since 2017, when it began the cat-and-mouse game of cracking down on political actors seeking to manipulate public debate on its platform. The report, which summarizes 150 disinformation operations the company says it has disrupted in that period, highlights how such coordinated efforts have become more sophisticated and costly to run in recent years — even as these operators struggle to influence large numbers of people as they once did.

Meanwhile, more players have learned from the Russian example and have started disinformation operations in their own countries, Facebook says. That includes networks of shadowy public relations firms that sometimes do work for both sides within a country, as well as politicians, fringe political groups, and governments themselves, said Nathaniel Gleicher, Facebook’s head of security policy, in a media call.

“It started out as an elite sport, but now we see more and more people getting into the game,” said Gleicher, who added that such efforts increasingly resemble influence operations that were conducted before social media, “narrower, more targeted, expensive, time-consuming, and with a lower success rate.”

In 2017, Facebook discovered a vast influence operation, in which the Russian Internet Research Agency had subjected 126 million of the platform’s users to political disinformation ahead of the previous year’s election. Since then, the social network has invested resources in policing its service — including hiring more than 10,000 third-party content moderators and subject matter experts — and building algorithms to scan for unwanted content.

The big caveat to the report is that Facebook and other social media platforms see only the nefarious operations that they uncover — and do not know about the broader universe of disinformation that goes undetected.

“I think we should be careful about saying that we know what the denominator is,” Gleicher said.

Russian content on Facebook, Google and Twitter reached far more users than companies first disclosed, congressional testimony says

Some insiders have alleged that Facebook executives ignored certain areas of disinformation in some countries despite internal flags, according to reporting by The Washington Post and other media reports. They claim that political hesitancy around dinging certain politicians and parties, as well as prioritizing policing what are deemed more important elections, events, and geographies, have led to problems. Facebook has disputed those allegations.

In recent years, no other social media influence campaign that the company has detected has appeared to achieve the scale of the 2016 Russian operation. But the initial campaign also was unsophisticated in some respects. Posts often included grammatical errors that suggested non-English speakers were writing them, for example.

Since then, operators have had to devise new methods to co-opt the public.

One strategy has involved recruiting native speakers, and another involves seeking a more targeted audience to manipulate, according to the report. In early 2020, for example, Facebook disrupted a Russian military operation targeting Ukraine that created Facebook profiles of fake people purporting to be journalists. The fake journalists tried to contact and influence policymakers and influential people directly but did not appear to try to build a large Facebook audience, the report said. Russia adopted a similar strategy for a modest disinformation operation in the United States as well, although in that operation actual journalists were recruited under false pretenses to represent fabricated news outlets.

The report reveals significant trends, including how the number of foreign disinformation operations compares to domestic ones (slightly more domestic) and whether most disinformation appeared to be politically or financially motivated (the latter, but it’s not always possible to tell who is paying the shadowy PR firm).

The top countries Facebook identified as originators of most disinformation operations both domestic and foreign were Russia, Iran, Myanmar, the United States and Ukraine.

The countries that were most frequently targeted by foreign disinformation operations were the United States, Ukraine, Britain, Libya and Sudan.

As operations grow more sophisticated, it can become harder to distinguish them from authentic political activity, the report noted. That problem was particularly acute in the 2020 U.S. election, which the report described as a “a watershed moment in the recent history of influence operations.”

Facebook takes down Russian operation that recruited U.S. journalists, amid rising concerns about election misinformation

Russia, Iran and China all tried to influence public debate ahead of the vote, apparently with limited results, the report said. The most elaborate effort involved the Russian Internet Research Agency hiring people in Ghana to impersonate Black Americans discussing politics and issues of race. Facebook also discovered a shadowy network run by people in Mexico who posted about issues of Hispanic pride and the Black Lives Matter movement. The report noted that the FBI later connected this operation to the Russian IRA.

By contrast, domestic disinformation had a much greater impact that foreign. The five U.S.-based operations the company exposed heading into the 2020 election featured domestic political players who were abusing Facebook’s rules.
Four out of the five were on the political right.

One was Rally Forge, a U.S.-based marketing firm that hired a staff of teenagers to sow disinformation and was affiliated with the pro-Trump political action committee Turning Point USA, The Washington Post first reported. The others were groups affiliated with the violent conspiracy theory QAnon, a website dedicated to promoting white identity and criticizing immigration, an “inauthentic” network tied to Trump advisor Roger Stone and the Proud Boys militia group.

In addition, shortly after the election Facebook took down an “inauthentic” network tied to former Trump advisor Steve Bannon. The company did not put this takedown into the report because it did not rise to the level of a full-scale disinformation operation.

One trend the report highlighted was the rise in “perception hacking,” in which the prospect of an influence operation helps cast doubt on the authenticity of public debate.

As the United States headed into the 2018 midterms, Facebook found that Russia’s IRA had created and broadcast a website, usaira.ru, complete with an “election countdown” timer where the agency claimed to have been creating nearly 100 fake Instagram accounts.

“These fake accounts were hardly the hallmark of a sophisticated operation, rather they were an attempt to create the perception of influence,” the report noted.

Click to expand...

A video shared by Texas Sen. Ted Cruz last week to attack the US military for being "woke" and "emasculated" originated from pro-Russian, anti-American far-right social media networks, experts on extremist propaganda have told Insider.

The video, which had been initially uploaded to TikTok, sought to unfavorably compare a US military recruitment ad to a Russian army one. The US Army clip featured an animation telling of a female corporal's life, while the Russian ad used masculine tropes, featuring fighter jets and shirtless men doing pushups.

"Holy crap," Cruz wrote in his retweet of the video. "Perhaps a woke, emasculated army is not the best idea…"



Alexander Reid Ross, a fellow at the UK's Centre for the Analysis of the Radical Right who specializes in mapping the spread far-right propaganda, told Insider that he had monitored the meme as it spread from pro-Russian and far-right networks to Cruz's Twitter feed over the course of a week.

The case illustrates the route far-right propaganda can take from fringe pro-Kremlin and white supremacist networks, into mainstream Republican platforms.

From Kremlin ally to 4chan to Ted Cruz's Twitter
Here is the timeline for the spread of the video, according to Ross' analysis:

• The earliest comparison of the recruitment videos was in two May 13 tweets by Koskovics Zoltán, an analyst at the Center for Fundamental Rights in Budapest. The center is linked to the far-right government of Hungary's Prime Minister Victor Orban, an ally of Russian President Vladimir Putin.
• Zoltán's first tweet linked to a Vimeo page showing the Russian recruitment ad, and the second tweet linked to a post by the journalist Alan MacLeod slamming the "super-woke" US Army video. MacLeod is a frequent critic of western media outlets' coverage of Kremlin policy. (In an email to Insider, MacLeod said that though he was a critic of western media coverage of Russia, he was anti-Kremlin.)

• Zoltán's tweets were cited on May 14 by the Russian far-right outlet Krasnaya Vesnya and the American conservative blog Red State. Both posts mocked the comparison between the Russian and US armies.
• Gavin McInnes, founder of the far-right Proud Boys group, discussed the recruitment videos in his YouTube show on May 15.
• The two videos were then posted and discussed in threads on 4chan, the messaging board that serves as a key online hub for the right.
• On May 17, the Russian and US recruitment videos were stitched together and posted on TikTok as a single video.
• From there, the video — in its slightly altered form — was shared widely in white-supremacist forums on Telegram, the encrypted messaging app that's become a haven for extremists ousted from mainstream platforms.
• The first post featuring the TikTok on Telegram was shared by an account that posts "white nationalist and fascist content," Ross told Insider. The post had spread, Ross said, in forums popular with the US white supremacist National Justice Party, the white-nationalist Groypers group, and the Russian ultra-nationalist National Bolsheviks.
• On May 18, the TikTok was uploaded to Twitter for the first time. Insider has seen the post, which has as of Tuesday been retweeted 1,000 times.
• On May 19, Rando Quaaden, a Dutch account that has posted tweets in support of the European far-right Identitarian movement and Syrian dictator Bashar al-Assad, tweeted the TikTok.
• On May 19, Pardes Seleh, a Texas realtor who posts conservative content on Twitter, shared the video posted by Rando Quaaden.
• And on May 20, Cruz retweeted Seleh.

Ross maintains that the version shared by Cruz made the leap onto Twitter from Telegram extremist networks. Rando Quaaden disputed this on Monday, calling it a "non-existent pipeline."

Ross said that the core message of the video was that liberalism was making the US weak, in comparison with the strength of Putin's traditionalist Russia.

"The blunt impact of the meme, for fascists, is that the US's liberal system is seen globally as a joke, and cannot stand up to other Great Powers," he said.

"The US far right picks up on pro-Kremlin propaganda, because it agrees with efforts to undermine liberalism, even when they attack nonpartisan US institutions," Ross said.

"That Republicans ally with illiberal propaganda spread by foreign adversaries should give us pause with regards to their claims to putting 'America First.'"

Cruz's response
A spokesman for Cruz told Insider that the controversy over the source of the video was distracting from the more important issue of how "wokeness" is undermining the US military.

"Sen. Cruz shared a widely-circulated video that shows wokeness is undermining the seriousness and purpose of our military. But instead of discussing this very real problem, journalists are dusting off absurd Democrat talking points and claiming the real issue here is racism, Russian propaganda, or both. They're so invested in this liberal narrative they will destroy innocent people's lives to advance it," said the spokesman.

Cruz last week claimed to be enjoying the controversy caused by the video, tweeting: "I'm enjoying lefty blue checkmarks losing their minds over this tweet, dishonestly claiming that I'm "attacking the military."

In an apparent response to Insider's request for comment, Seleh tweeted a screenshot of Insider's message, saying: "These people have been trying to destroy my life for the past week because I shared a funny TikTok video that Ted Cruz retweeted. I don't even know how to answer this. Is TikTok considered a 'white supremacist forum'??"

'US conservatives ... have frequently promoted Russian propaganda'
Critics have long warned of the dangerous melding of mainstream Republican propaganda and memes, and disinformation from extremist movements and forums.

Alex Newhouse, an expert in far-right extremism at the Middlebury Institute of International Studies, backed Ross' assessment that the video was distributed widely among white supremacists on Telegram before being distributed on Twitter.

"US conservatives — especially those in the midst of the pro-Trump movement, and those outside the mainstream — have frequently promoted Russian propaganda through various channels," he told Insider.

Newhouse pointed to Trump's former national security advisor Michael Flynn's ties to Russian state TV network RT, and a segment on the far-right US network OANN last year on election fraud that was partly written by a former associate of the Russian state-news agency Sputnik.

Republicans have opposed measures in recent years to make the US military more inclusive, with Cruz in 2016 criticizing plans to allow servicewomen to serve in combat roles.

Click to expand...

SAN FRANCISCO — It can feel abstract: A group of organized but faceless criminals hijacking corporate computer systems and demanding millions of dollars in exchange for their safe return. But the impact of these ransomware attacks is increasingly, unavoidably, real for everyday people.

These crimes have resulted in missed chemotherapy appointments and delayed ambulances, lost school days, and transportation problems. A ransomware attack onColonial Pipeline in May led to gas shortages and even dangerous situations caused by panic buying. This past week, hackers compromised the JBS meat processing company, leading to worries about meat shortages or other key food providers being at risk. Last fall, the Baltimore County Public Schools system was hit with ransomware and forced to halt classes for two days, which were being held virtually.

As recently as Wednesday, ransomware attacks were causing problems across the country. In Martha’s Vineyard, the ferry service transporting people to and from the Massachusetts island said it had been hit by a ransomware attack that disrupted its ticketing and reservation process. Ferries continued operating all week, but the ticketing system was still affected, causing delays, on Friday.

The recent spate of high-profile ransomware incidents is exactly what cybersecurity professionals have been warning about for years. But it’s partially the impact on everyday people — far from the executive suites, cybersecurity companies, or government agencies that regularly fret about the criminal enterprise — that has made the risk more visible. The ripple effects of ransomware can result in everything from mild inconvenience to people losing their lives, and it’s only increased in frequency during the pandemic.

Ransomware attacks could reach ‘pandemic’ proportions. What to know after the pipeline hack.

“It’s not only that it’s getting worse, but it’s the worst possible time for it to happen,” said Robert Lee, chief executive of Dragos, an industrial cybersecurity firm. He says on average, there are likely 20 to 30 big ransomware cases happening behind the scenes in addition to the ones making headlines.

Ransomware attacks are not new. The money at stake has changed drastically, however, inflating from thousands to millions of dollars, and the targets are more sophisticated as well. The increasing number of companies connecting their systems and adding more remote access points, along with things like the widespread use of bitcoin, have widened the pool of targets. Cybercriminals once focused on small companies and individuals but have made headlines this year for attacks on higher-profile victims.

“Now you’ve got ransomware affecting whole corporate networks, interrupting critical national function, causing disruption in people’s lives. It’s really become a national security, public health and safety threat,” said Michael Daniel, president and CEO of the nonprofit group Cyber Threat Alliance.

The ransomware industry has grown but the underlying techniques for gaining access have largely stayed the same.
Hackers commonly access companies’ systems through “phishing” attacks — emails sent to try to trick employees into giving up passwords or access. Once inside a company’s system, ransomware outfits will find critical information and lock it down, then contact a company to demand a ransom for it to be released.

These criminals generally work in loosely defined groups, sharing tips and resources that make it possible for individual hackers to easily extort multiple targets. Companies occasionally have backup copies of their systems that they can restore rather than pay a ransom. But that can result in delays, and sometimes hackers make copies of the information they access and threaten to leak private information online if they are not paid. A big data leak could be a huge issue for consumers, not just the companies.

“There’s this awful downward spiral of societal harm that happens from ransomware,” said Megan Stifel, co-chair of the ransomware task force and an executive director at the Global Cyber Alliance.

The Colonial Pipeline attack was one of the many worst-case scenarios experts have been warning about, and planning for, for years. A ransomware attack last month caused the company to shut down its pipeline connecting Texas to New Jersey.

Colonial hack exposed government’s light-touch oversight of pipeline cybersecurity

Panicked that they wouldn’t be able to get enough fuel, drivers swarmed gas stations, resulting in long lines and barren gas pumps in parts of the U.S. Drivers hoarded fuel as stations ran out of their supply, exacerbating the issue. The attack sparked a real-world fire in a Florida town, according to local news reports, when a Hummer burst into flames after the driver filled up four gas containers. The panic buying even prompted the U.S. Consumer Product Safety Commission to issue a long tweet thread about gas safety, including a message that quickly went viral: “Do not fill plastic bags with gasoline.”

People’s safety has been even more directly threatened by attacks on health care systems. Hospitals have been particularly hard hit, as far back as 2016 when the Hollywood Presbyterian Medical hospital paid $17,000 in bitcoin to a ransomware hacker. Last November, the University of Vermont Medical Center was hit by ransomware and it took nearly a month for it to regain access to its medical records. Chemotherapy patients had their treatments delayed, and were sent to other health centers where some had to recreate their medical history.

Joshua Corman, the chief strategist for health care and covid on the government’s Cybersecurity and Infrastructure Security Agency COVID Task Force, has been studying the potential impact of health-care attacks on mortality rates. For example, if a hospital has to close suddenly, ambulances might take longer to reach people in distress.

“Minutes can be the difference between life and death for heart attacks, and hour or two can be the difference for a stroke,” said Corman.

Lee, the head of Dragos, recently worked with a power company that got hit with a ransomware attack but was able to maintain operations. However, attacks like that could easily result in localized power shortages, he says. Attacks on pharmaceutical companies, or any of the manufacturers in their pipeline, could delay critical medicine like insulin or even vaccines. The increased targeting of industries with the most potential for disruption may be the criminals’ business decision.

“It feels like these groups realize industrial companies are more ready to pay out and more quick to pay out, because if you impact industrial operations you have to get up and going for safety and community,” said Lee.

Beyond the physical inconveniences, ransomware attacks can also hurt public trust in technology and systems, and cause people to worry they’ll be a victim or to panic-buy products they think will see a price hike or be in short supply, according to Stifel.

The Biden administration seeks to rally allies and the private sector against the ransomware threat

Panic after attacks is part of the problem. This past week’s attack on JBS, one of the largest meat-processing companies in the world, resulted in temporary factory shutdowns. While there were not yet any confirmed meat shortages in the U.S., worried meat suppliers still warned consumers not to panic buy beef, which could cause otherwise still stable prices to go up.

From higher gas prices to canceled surgeries, real-world financial and consumer safety implications of these hacks have spurred the federal government to crack down on ransomware. It’s investigating the causes, working on guidelines, and urging corporate America to take cybersecurity protections seriously.

“We’ve been warning about this overtly for more than eight years and a lot more quietly for longer, but now that its manifested, the silver lining is that we’re not starting ice cold,” said CISA’s Corman.

Click to expand...

Grandpapy said:

Sounds like it's about time to declare war.

Click to expand...

Grandpapy said:

Sounds like it's about time to declare war.

Click to expand...

MOSCOW — The ransomware hackers suspected of targeting Colonial Pipeline and other businesses around the world have a strict set of rules.

First and foremost: Don’t target Russia or friendly states. It’s even hard-wired into the malware, including coding to prevent hacks on Moscow’s ally Syria, according to cybersecurity experts who have analyzed the malware’s digital fingerprints.

They say the reasons appear clear.

“In the West you say, ‘Don’t . . . where you eat,’ ” said Dmitry Smilyanets, a former Russia-based hacker who is now an intelligence analyst at Recorded Future, a cybersecurity company with offices in Washington and other cities around the world. “It’s a red line.”

Targeting Russia could mean a knock on the door from state security agents, he said. But attacking Western enterprises is unlikely to trigger a crackdown.

The relationship between the Russian government and ransomware criminals allegedly operating from within the country is expected to be a point of tension between President Biden and Russia’s Vladimir Putin at their planned summit in Geneva on Wednesday. The United States has accused Russia of acting as a haven for hackers by tolerating their activities — as long as they are directed outside the country.

Biden and allies have said Russia appears to be the base for the masterminds of DarkSide and REvil, the cybercriminal groups linked to recent high-profile ransomware attacks on Colonial Pipeline and the U.S. operations and other markets of JBS, a Brazil-based company and the world’s largest meat supplier. There is no clear evidence the Kremlin was directly involved.

But Moscow has “some responsibility to deal with this,” Biden said last month.

The Biden administration seeks to rally allies and the private sector against the ransomware threat



But with other hackers, there appeared to be a sort of handshake deal, cybersecurity experts speculate. As long as hackers left alone Russia and selected friendly countries, they could largely do as they wished without fear of a crackdown or extradition, the analysts said.

“If you look at the ransomware code for most of these actors, it will not install on systems that have a Russian-language keyboard, are coming from Russian IP addresses or have the Russian-language packs installed,” said Allan Liska, Recorded Future’s ransomware expert.

“In these underground forums, they explicitly say there’s no going after Russian targets,” he added. “And that allows them to operate with impunity. . . . They are not operating at the behest of Russia, but they’re operating with the tacit acknowledgment of Russia.”

The Kremlin has been dismissive of U.S. complaints that Russia is harboring cybercriminals. Spokesman Dmitry Peskov said last week that hackers exist everywhere. In an apparent reference to the ransomware attack on JBS, Putin told state television that Russia does not “deal with some chicken or beef. This is just ridiculous.”

'Underground is just growing'

Smilyanets said that it was money that pulled him into hacking. When the Soviet Union collapsed in 1991, Russia inherited a top-tier educational system, but the country was broke and there were few job opportunities.

The son of a teacher and a police investigator, the 37-year-old former hacker said he was just a “regular kid.” He studied at the information security department at Moscow State Technical University.

“Even with this diploma, I couldn’t find a job,” said Smilyanets, who was extradited to the United States in 2012 after being arrested in the Netherlands. In 2015, he pleaded guilty to conspiracy to commit wire fraud and was sentenced to four years in prison for his role in one of the largest credit card data breaches to be prosecuted in the United States. (U.S. authorities spelled his name Dmitriy Smilianets.)

“I had to find money,” he said of his years after university. “Somebody showed me the way [into hacking]. I believe that happens to a lot of young, smart kids in Russia.”

Smilyanets said the draw to cybercrime is now stronger than ever “because there is so much money to be made.”

Andrei Soldatov, a Russian Internet analyst and author of “The Red Web: The Struggle Between Russia’s Digital Dictators and the New Online Revolutionaries,” said an entire generation of Russia’s skilled hackers grew up in the ’90s and blamed the West for Russia’s hardships after the Soviet Union unraveled.

That made them happy to comply with the unwritten hacking rule of operating in Russia: Do not to target Russia or any of the former Soviet Union. Of DarkSide’s 99 known ransomware targets, 66 were based in the United States, according to a list provided by Recorded Future. Most of the rest were in Europe.

Feds recover more than $2 million in ransomware payments from Colonial Pipeline hackers

Hackers in Russia feel that they have “nothing to worry about,” Smilyanets said. For cybercriminals, the country is like a greenhouse, he said.



“If you wanted to pretend to be Russian and jump on these forums, I think they would notice any peculiarities in the language,” Liska said. “A nonnative speaker would have trouble kind of fitting in naturally.”

Dmitry Galov, a security researcher at Kaspersky, a top Russian cybersecurity firm, said the evidence is weak to definitively trace the ransomware attacks back to Russia.

“It’s pretty tricky because when someone is speaking English on dark net forums, no one says that it is England behind the attacks,” Galov said. “They might be afraid that Russian cybersecurity experts will find them and catch them or whatever. There can be so many different reasons.”

In 2015, the FBI and the State Department announced a $3 million reward for information leading to the arrest of Russian hacker Evgeniy Bogachev, making him the most-wanted cybercriminal in the world. He was charged with conspiracy, money laundering and various fraud charges after allegedly siphoning more than $100 million from American bank accounts.



It would be a similar approach to how the Kremlin uses mercenaries from the shadowy paramilitary group Wagner, according to Western intelligence agencies, to represent its interests in Syria and several African hot spots while allowing Russian officials to deny any involvement.

Last month, the Treasury Department stated that the Russian internal security service, the FSB, “cultivates and co-opts criminal hackers, including” a group called Evil Corp., “enabling them to engage in disruptive ransomware attacks.” Treasury sanctioned Evil Corp. in late 2019.

JBS, world’s biggest meat supplier, says its systems are coming back online after cyberattack shut down plants in U.S.

Connections to the state come at different levels, Arena said. Once your identity is known to Russian law enforcement, you may get a knock at the door from the local police saying they know you are stealing money and want a cut, he said.

“It starts at that kind of level, up until the point where you have nation states leveraging cybercrime,” Arena said.

In an interview with the Russian OSINT blog posted June 4 on the Telegram messaging app, REvil said that another attack on the United States had been avoided “at all costs.” But the rule was lifted after U.S. officials became “outraged” at the ransom attack on JBS last month.

“We do not want to play politics, but since we are being drawn into it, it is good,” the ransomware group was quoted as saying.
“Even if they pass a law prohibiting the ransom payments in the United States or put us on a terrorist list, this will not affect our work in any way.”

Click to expand...

mooray said:

Detente, I learned a new word today.

Biden having a conversation with Putin about hackers is a joke. Putin will try to help, but aw shucks it's just so hard to catch them all, then he's off laughing in the background.

Cut all ties with Russia.

Click to expand...