DNC Hackers Linked to Russian Activity Against Ukraine Two Years Ago

In the same way that a masterpiece bears the distinct signature of its maker, so does a masterpiece of malware. Consider the case of FANCY BEAR, one of the two groups that broke into the Democratic National Committee’s, or DNC, networks and which the intelligence community and cybersecurity pros believe to be connected to the Russian military intelligence service, or GRU. Crowdstrike, the company that found hackers on the DNC network, on Thursday published a report showing that FANCY BEAR used the same malware as part of combat operations in Eastern Ukraine in 2014, which enabled the Russian troops to better target Ukrainian artillery positions. It’s one of the strongest pieces of evidence to emerge to show the connection between the Russian military and the concerted effort to influence the 2016 presidential election through the publication of stolen emails.

The malware in question is called X-Agent. Cybersecurity group TrendMicro originally discovered it in 2015 and connected it to a broad espionage operation from the Russian government aimed at political and military targets in Ukraine and elsewhere in Europe.

It’s a piece of malware well known to the Putin-backed group that hacked the DNC, also known as FANCY BEAR. As Crowdstrike’s Dimitri Alperovitch describes in his June blog post on the DNC hack, the environment was sick with  “X-Agent malware with capabilities to do remote command execution, file transmission and keylogging.”

Here’s what’s new, according to Crowdstrike. In 2013, a Ukrainian soldier named Yaroslav Sherstuk, with the 55th Artillery brigade developed a mobile phone application to help aim its long guns. The Android app was intended “to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces.”

It was a math app for real time combat. Ukrainian soldiers using Soviet-era Howitzers had to  figure out the elevation of the target and the curvature of the earth, etc., using pen and paper, which took too much time. Sherstuk’s app did the same job quickly and easily: plug in the coordinates of the targets and the app would tell you settings that you needed to set for the Howitzer. Targeting time went from minutes to 15 seconds.

When fighting began in Ukraine, the app spread among users on VK (the Russian-language Facebook knock off) and the like, eventually reaching more than 9,000 downloads.

The Russian military realized that they could simply infect the app with X-Agent and the malware would spread as quickly as the app. “On 21 December 2014 the malicious variant of the Android application was first observed in limited public distribution on a Russian language, Ukrainian military forum. A late 2014 public release would place the development timeframe for this implant sometime between late-April 2013 and early December 2014,” Crowdstrike writes in their report.

The pro-Russian fighters could find Ukrainian soldiers who were using the app to plan howitzer fires because the Ukrainians had given away their position through the app. The app asks the user for "course location" rather than GPS location, which would give an adversary a very general understanding of where an enemy was. The Russians could then send small drones to pinpoint the artillery soldier and those around him. As a result, Russian artillery launched more than 120 attacks on Ukrainians in 2014 between the July 9 and Sept. 5. 

As open source investigative group Bellingcat makes clear in this post: “In the days and weeks that followed, the units at the border were subjected to dozens of additional artillery attacks. By late July 2014, the massive bombardment reversed Ukrainian gains and contributed to the encirclement of portions of the Ukrainian armed forces. A separatist offensive across eastern Ukraine began simultaneously with the artillery attacks, leading to the separatists capturing much of the Russian-Ukrainian border along with vast areas of the Donetsk and Lugansk oblasts. “The pressure of sustained artillery attacks through early August led Ukrainian armed forces to lose control of hundreds of kilometers of border territory.” By some estimates, they lost more than 80 percent of their D-30 Howitzers, well beyond what they lost for other artillery pieces. The spread of infected apps may have played a role in better drone targeting but no hard proof it certainly did.

Bottom line: The presence of the same bit of malware on the phones of Ukrainian soldiers just before they were fired on in 2014 – and then in the DNC servers just before embarrassing emails were published to Wikileaks in 2016  -- is more than a coincidence. X Agent is not the sort of thing you find on GitHub. “We have only seen it used by FANCY BEAR. The source code for it has never been found on any public or underground forum,” Alperovitch told Defense One.

What this shows is that the same Putin-backed actors that targeted the DNC were targeting soldiers in Ukraine in 2014. And it is unlikely that a 400 pound U.S. hacker (or for that matter, the Chinese) were helping Russian forces target Ukrainian Howitzers in the Donbass in 2014.