Russian military agents allegedly hacked the Ukrainian gas company at the centre of the scandal that led to U.S. President Donald Trump’s impeachment, in a Jan. 13, 2020 story. (Photo by THE ASSOCIATED PRESS)

Russians hacked company key to Ukraine scandal: researchers

BOSTON — A U.S. cybersecurity company says Russian military agents have successfully hacked the Ukrainian gas company at the centre of the scandal that led to President Donald Trump’s impeachment.

Russian agents launched a phishing campaign in early November to steal the login credentials of employees of Burisma Holdings, the gas company, according to Area 1 Security, a Silicon Valley company that specializes in email security.

Hunter Biden, son of former U.S. vice-president and Democratic presidential hopeful Joe Biden, previously served on Burisma’s board.

It was not clear what the hackers were looking for or may have obtained, said Area 1’s CEO, Oren Falkowitz, who called the findings “incontrovertible” and posted an eight-page report. But the timing of the operation suggests that the Russian agents could be searching for material that damaging to the Bidens.

The House of Representatives impeached Trump in December for abusing the power of his office by enlisting the Ukrainian government to investigate Biden, a political rival, ahead of the 2020 election. A second charge accused Trump of obstructing a congressional investigation into the matter.

“Our report doesn’t make any claims as to what the intent of the hackers were, what they might have been looking for, what they are going to do with their success. We just point out that this is a campaign that’s going on,” said Falkowitz, a former National Security Agency offensive hacker whose company’s clients include candidates for U.S. federal elected offices. In an earlier interview, he told The Associated Press that top candidates for the U.S. presidency and House and Senate races in 2020 have in the past few months each been targeted by about a thousand phishing emails.

Falkowitz did not name the candidates. Nor would he name any clients.

Russian hackers from the same military intelligence unit that Area 1 said was behind the operation targeting Burisma have been indicted for hacking emails from the Democratic National Committee and the chairman of Hillary Clinton’s campaign during the 2016 presidential race.

Stolen emails were released online at the time by Russian agents and WikiLeaks in an effort to favour Trump, special counsel Robert Mueller determined in his investigation.

Area 1 discovered the phishing campaign by the Russian military intelligence unit, known as the GRU, on New Year’s Eve, said Falkowitz, who would not discuss whom he notified prior to going public. He said he followed the industry standard process of responsible disclosure, which would include notifying Burisma.

In the report, he said the GRU agents used fake, lookalike domains in the phishing campaign that were designed to mimic the sites of real Burisma subsidiaries.

Falkowitz said the operation targeting Burisma involved tactics, techniques and procedures that GRU agents had used repeatedly in other phishing operations, matching “several patterns that lots of independent researchers agree mimic this particular Russian actor.” Area 1 says it has been tracking the Russian agents for several years.

The discovery’s timing — just weeks before presidential primaries begin in the United States — highlights the need to protect political campaigns from targeted phishing attacks, which are behind 95 per cent of all information breaches, said Falkowitz.

“This is a real specific, timely case that has real implications,” he said. “To discover it and potentially get out in front of it is a significant departure from what’s typical in the cyber security community, where someone just tells you, yeah, you’re dead.”

In phishing, an attacker uses a targeted email to lure a target to a fake site that resembles a familiar one. There, unwitting victims enter their usernames and passwords, which the hackers then harvest. Phished credentials allow attackers both to rifle through a victim’s stored email and masquerade as that person.

Area 1 said its researchers connected the phishing campaign targeting Burisma to an effort earlier last year that targeted Kvartal 95, a media organiza tion founded by Ukrainian President Volodymyr Zelenskiy.

In this case, the Russian military agents, from a group security researchers call “Fancy Bear,” peppered Burisma employees with emails designed to look like internal messages.

In order to detect phishing attacks, Area 1 maintains a global network of sensors designed to sniff out and block them before they reach their targets.

In July, the U.S. Federal Elections Commission gave Area 1 permission to offer its services to candidates for federal elected office and political committees at the same low rates it charges non-profits.

By The Associated Press

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

College expects lower enrolment but president remains optimistic

International travel restrictions will have big impact on foreign students

Alberta’s active COVID-19 cases continue to trend downwards

85 new cases Tuesday, active cases sit at 1,004

Overwhelming majority of Red Deer students could be back in classrooms this fall

Preliminary survey results show 94 per cent parental support

Some Red Deer County residents oppose a gravel pit proposed for a flood-prone area

Howell’s Excavation co-owner says the proposal meets or exceeds standards

Workers at Regina linen company contract COVID-19 but facility safe: officials

REGINA — Health officials say 18 employees at a linen facility in… Continue reading

Alberta reports 257 new cases of COVID-19

The Alberta government reported 257 new cases of COVID-19 in its latest… Continue reading

Cast your votes for Best of Red Deer

The Advocate’s Best of Red Deer Readers’ Choice Awards are back. Community… Continue reading

Private school plans including smaller classes show stark inequities in education

Private school plans including smaller classes show stark inequities in education

Scrutiny of WE Charity focused on ability to deliver grant program: PCO clerk

Scrutiny of WE Charity focused on ability to deliver grant program: PCO clerk

B.C. students won’t return to class as originally planned on Sept. 8

B.C. students won’t return to class as originally planned on Sept. 8

Safety won’t be compromised for vaccine, Canada’s top doctors say

Safety won’t be compromised for vaccine, Canada’s top doctors say

More COVID cases among Manitoba meat plant staff, but no closure planned

More COVID cases among Manitoba meat plant staff, but no closure planned

Air Canada to launch revamped Aeroplan amid devastated travel industry

Air Canada to launch revamped Aeroplan amid devastated travel industry

Prosecutor won’t act on low-level Portland protest arrests

Prosecutor won’t act on low-level Portland protest arrests

Most Read