The newest GRU indictment is a roadmap for Election Day disruption

[Nevilledog]

Link to tweet

Tweet text:
Molly McKew
@MollyMcKew
Today, more detail was revealed by CISA about extensive Russian cyber intrusions in US election/critical systems

The indictment of GRU hackers released Monday is a roadmap to understanding what Russian can do on Election Day

New on @RenewGreatPower /1

The newest GRU indictment is a roadmap for Election Day disruption
The US fired a warning shot at the Kremlin before the election — or maybe it’s a signal flare to alert Americans what may be coming
greatpower.us

https://www.greatpower.us/p/the-newest-gru-indictment-is-a-roadmap

On Monday, the Department of Justice unsealed the indictment of 6 hackers from Russia’s GRU (military intelligence agency) — members of Unit 74455, otherwise known as the hacker group “Sandworm” — for the “worldwide deployment of destructive malware and other disruptive actions in cyberspace.” It was quickly noted that none of the activities listed related to the 2020 US elections. But the wrong read on the indictment is that it has nothing to do with US election interference in 2020 because it doesn’t say that on the front page. The contents of the new indictment and its timing are entirely about the upcoming US elections and what might come after. It’s warning us about the scope and scale of operations that the Kremlin’s units for cyber operations attached to political warfare efforts (or active measures campaigns), including election interference, are capable of conducting.

The indictment connected the dots between a wide array of global cyberattacks over the past five years — hacking electoral campaigns in France; taking down electrical grids and banking systems in Ukraine; spillover effects of cyberattacks on Ukraine that crippled a US hospital system and some shipping services; a massive attack on government servers and thousands of websites in Georgia (the country, not the state); targeted attacks against institutions documenting Russia’s use of the nerve agent novichok in the attempted assassination of GRU defector Sergei Skripal in the UK; widespread attacks against South Korean and 2018 Olympics targets after Russian athletes were banned for doping — attributing some of them officially to Russia for the first time. The indictment made clear that this was a multi-nation intelligence effort to expose “intrusions and attacks intended to support Russian government efforts to undermine, retaliate against, or otherwise destabilize” all the target nations listed above.

“Sandworm” may not mean much to non-cyber obsessed humans: trying to follow hacker group nicknames and bravado is kind of like trying to immerse yourself in the complete Marvel universe mythology after the age of 40. But the broad range of activities attributed to Sandworm shows how much leeway such units are given by the Kremlin to probe and beta-test and operationalize different kinds of cyber weapons to expansively contribute to Russia’s strategic (and sometimes just petty) objectives within defined parameters. The pattern is one we see in other hybrid domains: just do stuff, maybe it works, and if not there are probably minimal consequences, and the Kremlin will just huff and puff and blow out denials anyway. There is a high risk-taking threshold. Thus we get the list of above activities that seem scattershot, but are not. They have a common operational core. They feed back into the same training process.

Exposing the names and identities of individual members of the unit is a significant step (one which not all former US intelligence officers I spoke to, leery of getting into a Cold War-style tit-for-tat unmasking of intelligence operatives, are wild about). In this case, though, releasing the names seemed to do double duty. Both the unit and one of the individuals had been previously named in Mueller’s indictment of hackers connected to 2016 US election interference efforts, including efforts to hack the DNC and personal emails and efforts to gain access to state level election systems in all 50 states. This indictment connects those 2016 cyberattacks to global efforts — and to ongoing attacks.

*snip*

[bronxiteforever]

1. Kick and recommend. This is a great read.

We need to amp up our cyber defense and I hope in Biden Administration it will be a defense priority. Time to bring the pain train to Vlad the Poisoner.

[BComplex]

2. And after 20 years of DUers and others screaming and hollering about election security, do

you think maybe someday the alphabet agencies will maybe, say, take a look at it?

I think every state needs a back-up paper ballot, and that those need to be hand counted to confirm the computer totals in every election. It's fine if they want to scan the ballots into a computer counting machine, but the original paper ballots need to be totaled by bipartisan counters to confirm before the vote should be certified.

That should do double-duty of making sure machines aren't hacked or having "issues", and letting voters know that their ballots are counted fairly. If a circle isn't filled in enough for the machine to pick it up, a pair of eyes will be able to see it and count it.

We need this done before an election is certified in every state.

[bluestarone]

3. I do worry about this. BECAUSE

It would be VERY easy for russia to succeed because of, RUMPS help. This administration will absolutely do everything they can to help russia succeed on election day!!! THEY HAVE A PLAN i'm afraid! NOV. 3rd in key states could have huge problems i'm thinking. (hope i'm wrong)

[DFW]

4. Directorate 74455 is one of three main players

There is also GRU directorate 26165 at Komsomolsky Prospekt 20 in Moscow and the so-called "Internet Research Agency" at Savushkina Street 55 in St. Petersburg.

All three of them are very active in trying to disrupt our elections--among other things! The election is their main occupation now because of the timing, but they don't just watch re-runs of "Bonanza" in the meantime.