CrowdStrike says malware implant was used to track movements of artillery units, adding to suspicions Russia is involved

A new report suggests the same hacking group believed to have hacked the Democrats during the recent presidential election also targeted Ukrainian artillery units over a two-year period, that if confirmed would add to suspicions they are Russian state operatives.

The report, issued by cybersecurity firm CrowdStrike, said a malware implant on Android devices was used to track the movements of Ukrainian artillery units and then target them. The hackers were able to access communications and geolocations of the devices, which meant the artillery could then be fired on and destroyed.

The report will further fuel concerns that Russia is deploying hacking and cyber-attacks as a tool of both war and foreign policy. The hack “extends Russian cyber-capabilities to the frontlines of the battlefield”, the report said.

Cozy Bear and Fancy Bear: did Russians hack Democratic party and if so, why? Read more

Russia gave military and logistical backing to separatists fighting against Ukrainian forces in east Ukraine, in a war that broke out in spring 2014.

The application was designed for use with the D-30 122mm towed howitzer, a Soviet-made artillery weapon still in use today. The app reduced firing times from minutes to seconds, according to the Ukrainian officer who designed it. However, it appears that the Android app was infected with a Trojan.



CrowdStrike said open-source research suggested that during the two years of conflict, Ukrainian artillery forces lost 50% of all weaponry but over 80% of their D-30 howitzers. The higher than average loss suggests data gained from the hack was then used to target the artillery.

Research has shown that Russia shelled Ukraine from inside its own territory, as well as sending weapons and troops over the border. Officially, Russia denied any major role in the conflict.

The malware was a version of the type used in the hack of the Democratic National Committee, CrowdStrike believes, making it highly likely that Fancy Bear, a hacking group believed to be based in Russia, was the culprit. “The source code to this malware has not been observed in the public domain and appears to have been developed uniquely by Fancy Bear,” CrowdStrike said.

US intelligence officials believe Fancy Bear works on behalf of the GRU, the intelligence agency of Russia’s army. Before the attack on the DNC, the same group is believed to have interfered on behalf of Russian interests in Georgia (pdf) and other countries bordering Russia.

“This cannot be a hands-off group or a bunch of criminals. They need to be in close communication with the Russian military,” CrowdStrike co-founder Dmitri Alperovitch told Reuters.

US officials believe Fancy Bear and other Russian hackers intervened in the election, with the aim of giving an advantage to Donald Trump. Both Fancy Bear and another supposedly Russian hacking group named Cozy Bear had hacked the DNC servers, according to analysts, without knowing about each other.

Vladimir Putin has dismissed the allegations as “hysteria”, while Trump himself has also rubbished the US intelligence assessment in recent days. But the new allegations, if proved, would make it harder to distance the activities of the hackers from the Russian state.

“CrowdStrike have been pretty reliable in the past, and their reports about the bears were independently verified,” said Andrei Soldatov, co-author of the Red Web, a recent book about the Russian internet. He said: “This doesn’t mean Fancy Bear is GRU: it could be, but not necessarily. But I think this new information means Fancy Bear is more incorporated into the Russian state than I might have thought before, and works with the military.”

However, Yaroslav Sherstyuk, the Ukrainian military officer who developed the app, wrote on Facebook that the report was “total nonsense”. He said he was personally in control of downloads of the app and that they were not compromised, suggesting the report itself might be a way to spread panic among Ukrainian military units.

