蘑菇视频

If you can figure out why a cyber attack may have occurred, you can better predict what鈥檚 next and act deliberately to manage risk to your organization. That鈥檚 a key takeaway from 蘑菇视频 Allen鈥檚 comprehensive new report, Bearing Witness: Uncovering the Logic Behind Russian Military Cyber Operations. The report details how the timing, targets, and impacts of Russia鈥檚 military intelligence agency鈥攖he GRU鈥攈as been linked to more than 200 espionage, disruption, and disinformation incidents and campaigns between 2004 and 2019.

Many organizations view cyber attacks as indiscriminate threats, but from financially driven 鈥減ray-and-spray鈥� attacks to highly targeted attacks by state-aligned adversaries, there鈥檚 a motivated threat actor for every attack鈥攅ven if it鈥檚 not immediately obvious to the victims. In this case, our report illustrates how GRU-linked operations directly responded to Russia鈥檚 concerns about specific geopolitical events and developments often by shaping beliefs and perceptions.

In this Q&A with the report鈥檚 authors, you鈥檒l gain insights into GRU cyber operations, how to better understand the drivers behind those operations, and the value of 鈥渢hreat-centric risk management.鈥�

What are some examples of how GRU attacks were influenced by specific events and larger strategic priorities?

From 2015 to 2017, the GRU repeatedly unleashed malware that wiped hard drives and twice disrupted local power distribution in Ukraine. According to 蘑菇视频 Allen鈥檚 assessment, these attacks were likely, in large part, a GRU response to Ukraine鈥檚 refusal to repay a geopolitically significant 2013 energy loan, compounded by a December 2015 IMF policy ruling that enabled Ukraine鈥檚 default. This contextual analysis better explains the motivating factors behind the attack than previous theories and directly ties to Russia鈥檚 strategic interest in enforced compliance with international agreements.

Also, in late 2016, the GRU repeatedly leaked documents from prominent U.S. democracy promotion groups. The spy agency鈥檚 personas and Russian state-linked media claimed the documents showed a vast illicit U.S. conspiracy to undermine elections in Russia and Eastern Europe. Our analysis showed the GRU sought to weaken then-emergent U.S. denunciations of Russia鈥檚 attempts to influence the 2016 U.S. presidential election. The leaks were framed to suggest a normative equivalence of all forms of foreign-linked political activity.

Who are the primary targets of the GRU鈥檚 cyber operations, and why?

The GRU鈥檚 immediate targets vary greatly, from sports organizations and religious figures to diplomats and critical infrastructure operators. Ultimately, the GRU seeks to influence specific groups (including cultural, ethnic, religious and national groups), policy elites (such as military and political leaders), and countries to be more open to鈥攐r at least less likely to oppose鈥擱ussian interests and policies. They do this through data leaks, disinformation campaigns, and targeted attacks against individuals or infrastructure intended to sway confidence and influence discourse.

Recognizing this risk, how should organizations change and evolve their cybersecurity approaches?

Cybersecurity teams need to track more overt state-linked actions, such as statements by diplomats and state-linked media and disinformation campaigns. These can signal a government鈥檚 goals, positions, and points of friction. For instance, in February 2020, several governments blamed the GRU for conducting cyber attacks on the Republic of Georgia. At the time of the attacks in October 2019, 蘑菇视频 Allen observed concurrent social media campaigns amplifying false narratives about hacktivist perpetrators and NATO鈥檚 relationship with Georgia, early public indications of the attribution, and likely motivations.

In addition, organizations should expand their focus beyond tracking easily measurable harms to larger strategic impacts. Consider how the GRU disrupted Ukraine鈥檚 first post-revolution presidential election in 2014. On election day, they leaked emails suggesting a conspiracy to help certain candidates, defaced the national election commission鈥檚 website with fake vote counts, and wiped associated systems. Russia鈥檚 cyber operations delayed the release of accurate vote totals for more than a day. Moreover, these tactics鈥攁nd the amplification of fraudulent results by Russian media鈥攊ntroduced confusion and threatened public confidence in the legitimacy of the newly elected government.

Although public confidence is difficult to measure, the results of such a campaign can be significant. Imagine, for example, the impact of these kinds of coordinated cyber information operations on the November 2020 U.S. presidential election. On a smaller scale, we recently saw firsthand how the U.S. public and news media reacted to delays in Iowa鈥檚 Democratic Caucus results.听

How can organizations protect themselves considering rapidly changing geopolitical circumstances and cyber responses?

Whether by for-profit criminals or 鈥渉acktivists鈥� advancing an ideology, cyber activities are goal-oriented. The goal for state actors conducting cyber operations is to bolster their national security and advance national interests. One approach to protect yourself is threat-centric risk management. It considers how operations against your organization would advance your adversary鈥檚 interests, with security strategies tailored to this understanding.

To implement threat-centric risk management, first create an organizational 鈥減rofile.鈥� It details your location(s), partners, customers, the information you possess, and so forth. Then consider your potential adversaries: Who are they? What do they want? How likely are they going to act on their objectives?

Once you鈥檝e established those parameters, risk management activities can include:

• Internal and external threat hunts focused on expected adversaries
• Playbooks and security controls based on expected attacks
• Tracking metrics to measure the impact of larger organizational decisions on your risk profile, including new lines of business, delivery models, and partnerships, or changes in your operating environment, such as political and social shifts

Learn more about state-sponsored cyber activity and threat-centric risk management by downloading the full 蘑菇视频 Allen report: Bearing Witness: Uncovering the Logic Behind Russian Military Cyber Operations.

听