Russian Cyber Operations on Steroids

Russian Cyber Operations On Steroids

ThreatConnect Identifies FANCY BEAR Ties to World Anti-Doping Agency Phishing

Read the full series of ThreatConnect posts following the DNC Breach: “Rebooting Watergate: Tapping into the Democratic National Committee“, “Shiny Object? Guccifer 2.0 and the DNC Breach“, “What’s in a Name Server?“, “Guccifer 2.0: the Man, the Myth, the Legend?“, “Guccifer 2.0: All Roads Lead to Russia“, “FANCY BEAR Has an (IT) Itch that They Can’t Scratch“, “Does a BEAR Leak in the Woods?“, “Russian Cyber Operations on Steroids“, and “Can a BEAR Fit Down a Rabbit Hole?“.

On August 15, the World Anti-Doping Agency (WADA) alerted stakeholders to phishing emails that used domains spoofing the WADA’s legitimate domain, wada-ama.org. WADA confirmed that some users had received illegitimate credential harvesting e-mails that look as though they came from the WADA. The domains in the alert included:

wada-awa[.]org

wada-arna[.]org

ThreatConnect’s Research team reviewed these domains and found that the sites were recently registered and their registration and hosting information are consistent with Russian FANCY BEAR tactics, techniques, and procedures (TTPs), as shown in the diamond model below. Further, we also identified another domain registered by the same individuals — tas-cass[.]org — that spoofs the Court of Arbitration for Sport’s (CAS) legitimate tas-cas.org domain.

WADA’s alert follows news from mid-August that WADA accounts and servers had been compromised. On August 11, a group identifying themselves as Anonymous Poland (@anpoland) defaced the CAS website and leaked data stolen from WADA and CAS servers. On August 13, the WADA and email accounts belonging to Yuliya Stepanova, the Russian athlete who was called “Judas” by Vladimir Putin for helping to blow the whistle on the state sponsored doping scandal, were hacked.

We assess that the phishing and Stepanova’s compromise most likely are part of targeted activity by Russian actors in response to the whistleblower and the WADA’s recommendation to ban all Russian athletes from the Olympic and Paralympic games in Rio de Janeiro, Brazil. Successful operations against these individuals and organizations could facilitate Russian efforts to privately or publically intimidate them or other potential whistleblowers. At this time, we are skeptical of @anpoland’s origins but cannot determine the extent to which, if any, they are a Russian platform similar to Guccifer 2.0 or DCLeaks.

ThreatConnect made a concerted effort to alert WADA and CAS to these findings and have shared indicators from this activity in ThreatConnect’s Incident 20160818A: Activity Targeting the WADA and CAS.

WADA and CAS Background

An international independent agency, the WADA is not only composed of, but funded by governments and the sport movement worldwide. One of the organization’s primary responsibilities is to monitor the World Anti-Doping Code.

The CAS is a the highest international tribunal that was established to settle disputes related to sport through arbitration. Starting in 2016, an anti-doping division of CAS began judging doping cases at the Olympic Games, replacing the IOC disciplinary commission.

McLaren Report and Russian Athletes Banned

In 2014, Stepanova, a Russian track athlete, and her husband, a former employee of the Russian Anti-Doping Agency, appeared in a documentary accusing the Russian sports system of large-scale doping fraud. They indicated that Russian athletics officials supplied banned substances in exchange for 5% of an athlete’s earnings and falsified tests together with doping control officers.

In May 2016, Dr. Grigory Rodchenkov, the former Director of Moscow and Sochi doping control laboratories, further alleged and detailed widespread efforts facilitated by Russian intelligence services to circumvent positive testing results for Russian athletes. The WADA then engaged Professor Richard McLaren to investigate allegations of Russian state manipulation of the doping control process for Russian athletes. On July 18, the results of McLaren’s investigation were released in a report that included findings on Moscow’s involvement in circumventing the testing process, including:

The State had the ability to transform a positive analytical result into a negative one by ordering that the analytical process of the Moscow Laboratory be altered. The Ministry of Sport (“MofS”), Russian Anti-Doping Agency (RUSADA) and the Russian Federal Security Service (the “FSB”) were all involved in this operation.

The MofS directed, controlled and oversaw the manipulation of athletes’ analytical results and sample swapping, with the active participation and assistance of the FSB; the Center of Sports Preparation of National Teams of Russia (CSP); and, both Moscow and Sochi laboratories.

Following the report, the WADA recommended that all Russian Olympic and Paralympic athletes be banned from the Rio games. The IOC ultimately cleared 271 of the 389 Olympic athletes for competition and the CAS upheld the ban while the International Paralympic Committee (IPC) banned the entire Russian Paralympic team from participation.

FANCY BEAR Consistencies

Investigating the two domains provided in the WADA alert — wada-awa[.]org and wada-arna[.]org — using SOA and WHOIS records we were able to identify that they were registered by rob_parks@mail[.]com and macie.dietrich50@mail[.]com respectively. Leveraging capabilities from our partners at DomainTools, we were able to identify that macie.dietrich50@mail[.]com had also registered one other domain — tas-cass[.]org — approximately three hours before registering wada-arna[.]org on August 8th. We found no other domains registered by rob_parks@mail[.]com.

The wada-awa[.]org and tas-cass[.]org domains are currently hosted at the same 81.95.5[.]166 (Germany) IP address with no other domains. While these domains were registered using different email addresses, their hosting at the same IP with no other domains suggests they were registered by the same individual or group. The wada-arna[.]org domain is currently hosted on a dedicated server at 149.154.157[.]171 (Italy).

Based on passive DNS resolutions identified through PassiveTotal and our integration with Farsight, we were able to identify that several subdomains for these domains are currently hosted on these IP addresses. These subdomains most likely have been used in operations against the WADA and/or CAS:

mail.wada-awa[.]org

inside.wada-arna[.]org

adfs.wada-awa[.]org

After taking a look at the name server information for the domains, we identified that wada-awa[.]org was registered and uses a name server from ITitch[.]com, a domain registrar that FANCY BEAR actors recently used to register a domain for operations against the Democratic Congressional Campaign Committee. Wada-arna[.]org and tas-cass[.]org were registered through and use name servers from Domains4bitcoins[.]com, a registrar that has also been associated with FANCY BEAR activity. Concentrations of FANCY BEAR domains have been found on the name servers for both of these registrars, and the registrars’ acceptance of anonymous Bitcoin payment is desirable for actors seeking to avoid attribution. The diamond model below shows the relationship between the identified domains, their registration and hosting information, known FANCY BEAR TTPs, and intended targets.

The WADA and CAS-spoofing domains and activity most likely are intended to support Russian government intelligence collection and/or influence operations related to the WADA and CAS. Our assessment is based on the following findings:

The registration of these domains on August 3rd and 8th, 2016 are consistent with the timeline in which the WADA recommended banning all Russian athletes from the Olympic and Paralympic games. The use of 1&1 mail.com webmail addresses to register domains matches a TTP we previously identified for FANCY BEAR actors. These domains were registered through ititch[.]com and domains4bitcoins[.]com, two registrars that accept Bitcoins for payments. The use of such registrars also matches an identified TTP for FANCY BEAR actors. Two of our previous blog posts also highlighted domains at the ITitch and Domains4bitcoins name servers and their associations to FANCY BEAR activity.

A review of recently registered domains using the same name servers identified two other domains related to sports and athletics — espn-com[.]co and espn-live[.]co. Espn-live.co was registered through ITitch on August 17. Espn-com[.]co was registered through ITitch on August 2, a day before wada-awa[.]org was registered through the same service. These domains no longer use ITitch name servers as both most likely were taken over by MarkMonitor on ESPN’s behalf shortly after they were registered. No information on the original registrants could be identified and we do not have any indication that these domains were used maliciously; however, based on the timing, subject matter, and registrar used, this may represent an additional avenue through which the actors intended to pursue WADA and CAS-related targets.

Anonymous Poland – What’s Their Role?

On August 12, 2016 hackread.com broke the story that the WADA and CAS had been hacked and thousands of accounts had been leaked. The subtitle for the story read: Anonymous Poland Hacked World Anti-doping Agency and Court of Arbitration for sport’s server’ server and leaked personal details for God knows what reason!

We asked ourselves that very question – what beef does Anonymous Poland (@anpoland) have with WADA and CAS? While it is plausible that the attacks were in response to the Tomasz Zielinski being sent home for testing positive for a banned steroid nandrolone on August 9, such retaliation efforts are atypical for Anonymous Poland, which has previously focused on Polish politics and perceived issues with the financial, political, and media industries. To that end, is it possible that @anpoland is another platform that Russians are using to hide their hand in activity against the WADA and CAS?

Of course, activity against WADA and CAS from hacktivists and Russian state sponsored actors are not mutually exclusive, so it is entirely possible that two groups could have targeted and/or compromised these organizations at the same time. However, the timing associated with the Russian phishing activity and Anonymous Poland’s claims are very coincidental and suggest that the two may be involved. To that end, we reviewed Anonymous Poland’s activities to determine whether they are whom they claim to be. Our findings include the following:

@anpoland posted a video to Youtube that demonstrates how they purportedly used Acunetix to scan the CAS website and SQLMap to exploit CAS databases. The screen capture video shows the individual using a local admin account with Polish language settings. However, when the individual uses Firefox, we see in their browser history that they have previously issued Google searches from Google.ru (Russia) and Google.com (US) multiple times while Google.pl (Poland) is absent.

Google.ru within the browser history might indicate that the user that created the Youtube video is originating, or has previously originated, from a Russian IP address. Although the user has Tor browser on their desktop it appears as if they failed to execute it, as it does not appear as an executing process during the hack demo.

WADA Browser History

TAS Browser History

The @anpoland Twitter account being cited by various news outlets as a source for this story, appears to have been inactive until the end of July 2016. The @anpoland account was established in April 2010, the same timeframe as when Polish Air Force Flight 101 crashed several hundred meters short of the Smolensk airport runway in dense fog, killing everyone on board, including Polish President Kaczyński. Russia’s final report on the incident blamed the late president and his “inebriated” air force commander-in-chief for the accident. Beginning on August 1, the @anpoland account essentially resurfaced with claims that it had hacked the Ukrainian Ministry of Internal Affairs and released hacked documents pertaining at gmarine.com[.]ua – a Ukrainian website hosted on a Russian IP. It’s important to note that while the @anpoland account has a gap in posts from 2010 to 2016, it is possible the individual(s) running the account deleted older posts. Other social media accounts claiming affiliation with Anonymous Poland, such as @anonpoland , and Anonymous’ main twitter account are not publicizing the WADA compromise. The inability to confirm the @anpoland and HackRead story with several additional Anonymous Poland-related sources is suspect. Anonymous Poland Facebook accounts identified to date are focused on internal Polish politics and current events, apart from some posts referencing ISIS, most of the communications released call for action (mostly peaceful physical protests) in response to perceived issues with the financial, political, and media industries in the country.

At this time, based on a lack of sources, we cannot conclude that @anpoland is another platform that Russian actors are using for influence operations. However, mounting circumstantial evidence that negate @anpoland’s claimed origins makes us skeptical that they are in fact a legitimate Anonymous hacktivist group.

Fancy Bear’s Roid Rage

Ultimately, successful operations against WADA and CAS stakeholders could yield Russia with intelligence that could facilitate the following:

Follow-on operations seeking to influence or coerce individuals in key decision-making positions within those organizations. Such influence might ultimately result in decisions from those organizations that benefit Russian athletes. Document or data collection that can be used in influence operations or propaganda derisive to the WADA, CAS, or their stakeholders. Follow-on operations targeting specific individuals to gain additional collection. Intelligence collection that informs Russian efforts to circumvent doping and testing procedures, like those described in the McLaren Report. Publicly intimidate other potential whistleblowers and deter them from coming forward.

As evidenced in the Stepanova compromise, we would also expect to see additional Russian cyber operations targeting Professor McLaren and the main source of the investigation, Dr. Rodchenkov. Collection against these individuals could also facilitate Russian efforts like those previously listed, or effort to conduct influence operations that privately intimidate or publicly cast those individuals in a negative light.

Russian activity targeting these organizations is an important example of how Russia responds to wide-reaching current events that have negative implications for Moscow. Organizations involved in such events can reasonably expect to experience targeted Russian cyber operations that ultimately facilitate retaliatory influence or propaganda efforts against them. Knowledge of this TTP, and others associated with Russian APT activity, can help those organizations augment their security posture and defend against such retaliation.

ThreatConnect would very much like to work with WADA and Yuliya Stepanova if either would be open to sharing any details to help us better understand the details surrounding this event feel free to contact us.

Read the full series of ThreatConnect posts following the DNC Breach: “Rebooting Watergate: Tapping into the Democratic National Committee“, “Shiny Object? Guccifer 2.0 and the DNC Breach“, “What’s in a Name Server?“, “Guccifer 2.0: the Man, the Myth, the Legend?“, “Guccifer 2.0: All Roads Lead to Russia“, “FANCY BEAR Has an (IT) Itch that They Can’t Scratch“, “Does a BEAR Leak in the Woods?“, “Russian Cyber Operations on Steroids“, and “Can a BEAR Fit Down a Rabbit Hole?“.