Hello, World!
A Russian hacker wanted by the FBI has just been well - hacked, and evidence points to
this guy being the leader of Fancy Bear - the notorious Russian state sponsored elite hacking
group.
“SERGEY ALEKSANDROVICH MORGACHEV” has been wanted by the FBI for years.
Charged with ‘election interference’, ‘identity theft’, and ‘money laundering’,
he’s long been thought to be involved in some way or another with Russian state sponsored
hackers.
This made him a prime target of the Ukrainian hacktivist group, cyber resistance - like
other hacktivists on both sides of this conflict, these guys live on Telegram, though they claim
to “cooperate with various power structures of Ukraine”, in other words, they’re state
sponsored themselves.
And on April 10th they claimed to have hacked this guy, and not only linked him to Russian
state hackers, but identified him as the “leader of the hacker group APT 28” a group better
known by the name “Fancy Bear” - a pretty explosive allegation.
I mean, whenever we hear about Russian state hackers, the name “Fancy Bear” usually
comes up.
They have the longest wikipedia page of any state sponsored hacking group, and are thought
to be behind a whole array of cyber attacks spanning over a decade.
But what’s the actual evidence for this guy being the mastermind behind much of this?
Well, a complete ownage of his email account revealed quite a bit - his address, passport
scans, drivers license scans, and so on - there’s a lot here.
But most interesting is a form he filled out in order to receive Russian security clearance.
And according to section 4 of this document, which is about previous employment, up until
August of last year he was “Head of Department in military unit #26165’.
Which is the official name within the Russian intelligence service for ‘Fancy Bear’.
So, what happens now, what’re the ramifications of this hack?
Well, apart from extreme levels of embarrassment and his employer not being too happy, because
this leak was incredibly bad for him - I can’t show much of what was leaked because, well
- youtube police - but there’s even his medical certificates, the car he drives, his
CV - and the hackers even found the notification email he received from Apple, that the FBI
had subpoenaed his entire iCloud account.
But regardless, the guy was already wanted by the FBI - this leak might make him more
wanted I suppose, but so long as he doesn’t step foot outside of Russia, he’s safe.
Though the Ukrainian hacktivists didn’t let that stop them from getting their own
back.
The breach of his email account gave them access to his aliexpress account, through
which they placed large orders for FBI memorabilia and adult toys, paid for with his card, to
be sent to his home address.
And it’s not the first time ‘cyber resistance’ have abused aliexpress accounts.
A few weeks ago they gained access to the account of Mikhail Luchin - a drone operator
on the Russian side in the war, he’s often described as a “war influencer”, because
he documents his operations on Russian social media.
Mikhail recently raised $25 thousand dollars in a crowdfunding campaign, to be spent on
consumer drones for the Russian military, the kind that’ve proven pivotal on both
sides in the conflict.
However, after breaching his aliexpress account, ‘cyber resistance’ repurposed the entirety
of the 25 thousand dollars, again spending it on a wide variety of adult toys - for fear
of being smitten by the YouTube police I can’t go into much detail on that, but use your
imagination.
There’s no public details at all on how these two were hacked, but after all ‘cyber
resistance’ isn’t a research group, it’s a state backed threat group engaged in a hybrid
war.
There’s also been a bit of news on the Russian side of all of this.
In the last few days, Killnet - the pro Russian hacktivist collective, broke from their usual
modus operandi of DDoS attacks and instead leaked a bunch of NATO documents which seem
to have come from a protected web portal.
However, don’t get too excited, after checking several of the documents myself, almost all
of this stuff is available from public sources anyway, there’s nothing classified here.
Killnet seemingly gained access through a compromised set of credentials.
There’s also been some drama brewing within the Russian hacktivist community.
A few days ago, the leader of ‘Anonymous Russia’, a guy going by ‘Raty’ was arrested
in Belarus on unknown charges.
‘Anonymous Russia’ - is a pro Russian group, which like KillNet is primarily known
for DDoSing anti Russian organisations - one of their recent targets was the UK’s Mi5
website.
Like I say, we don’t know what prompted his arrest, because of course Belarus is aligned
with Russia in the war, and Raty was on their side, so there’s obviously more going on
here behind the scenes, at a guess, it’s possible the guy probably had some kind of
cyber criminal operations running concurrent to his hacktivism.
However, in a turn of events that was even more confusing, immediately after his arrest,
the leader of Killnet, KillMilk posted to his Telegram channel that he had “made a
difficult joint decision with the KILLNET COLLECTIVE team to deanon [one of his apparent
comrades].”
Essentially, he doxed Raty, revealing him to be one “Arseni Yeliseyeu”.
Probably butchered that one.
Why he did this to someone apparently on his side, we don’t know, all Killmilk said was
“Arseni (founder of Anonymous Russia) is a great guy and a patriot, but he was not
careful.
Now he is paying for it with his community and status.”
I think it’s fair to say the two likely just didn’t get on, and in an attempt to
consolidate power within the Russian hacktivist sphere, Killmilk took it upon himself to appoint
a new leader of ‘Anonymous Russia’.
But, to give you more context here, I should point out that if you spend some time in the
Killnet Telegram channel you’ll find it’s often used to advertise for paid courses,
so it’s clear that Killnet isn’t all about the hacktivism, their money making ventures
might have had some part to play in all of this drama.
As always thanks for watching and I’ll see you in the next video, have a good one