Dragonfly 2.0? Delta Elektroniks and Pre-embedded Malware

Delta Elektroniks highly likely supported by the Russian government and a direct threat to energy sector supply chain operations

Treadstone 71 asserts with high confidence that Delta Elektroniks (DE) is likely a front company directly associated with Energetic Bear (Dragonfly), and the equipment purchased from DE is vulnerable to supply chain threats due to malware embedded in the Taiwanese Delta Electronics (T-DE) programmable logic controller (PLC) software. T-DE is not aware of the infections allowing customers to download and install infected PLC software for the initial purposes of cyber espionage. Long-term intentions include possible physical sabotage operations and the potential to manipulate markets through false accidents (real but not due to human error or technology failure) to artificially drive up stocks (or down). Speculation of oil prices targeted to drive revenue when the price per barrel is too low to sustain economic plans. The PLCs appear to be genuine production parts with malware introduced post-production. Verification of Oleg Vladimirovich Strekozov’s identity is incomplete; the name is likely fictitious and probably state-sponsored. Evidence that suggests this outcome:

+++++++++++++++++++++++UPDATE+++++++++++++++++++ 1/4/2018+++++++++

https://ics-cert.us-cert.gov/advisories/ICSA-16-348-03

https://ics-cert.us-cert.gov/advisories/ICSA-18-004-01

Purely a Treadstone 71 effort

+++++++++++++++++++++1/4/2018++++++++++++++++++++++++++++++++++++++

Malware Targets SCADA Devices

  • TTPs are like Dragonfly (Strekozov as defined) or Energetic Bear (B2)
  • Targeting SCADA devices is consistent with espionage practices (B2)
    • Provides hackers a foothold into US critical infrastructure via trusted downloads – Delta Website in Taiwan (as one of many)
  • A copycat website in Russia is suspicious and consistent with masquerade techniques (C3)
  • A legitimate Russian business would not conduct themselves in such a way (C2)
  • Multiple other sites deliver the same software (C3) …

The full report: Intelligence Games in the Power Grid – 2016

The associated PPTX: Treadstone 71 Intelligence Games in the Power Grid

Our defenses are built for outside in. This is already in.  Anti-virus scanners do not detect any of this only sandbox analysis. ‘Trusted’ software is being downloaded from multiple different sites in multiple different languages covering multiple different industries. Data centers, buildings, power plants, hospitals, public safety, dams, nuclear facilities, financial services data centers, oil pipelines, military facilities, hotels, industrial automation, building automation, energy and ICT infrastructure, embedded power, automotive electronics (ships/boats), embedded power, various components thereof, merchant and mobile power, telecom energy, and renewable energy non-inclusively.

Recent reports from Symantec (outside in):

http://www.eweek.com/security/dragonfly-2.0-hackers-targeting-the-energy-sector-symantec-finds

https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group

https://www.reuters.com/article/us-usa-cyber-energy/u-s-warns-public-about-attacks-on-energy-industrial-firms-idUSKBN1CQ0IN RELEASED OCTOBER 20/21

 

Featured post

Zapad Exercises – 2nd/3rd Order Effects

 

The recent Russian Zapad wargaming exercises included a plethora of electronic capabilities demonstration and potentially more. Russia is known to recently been involved in illegal immigration efforts in Sweden, Finland, and Norway along with hostile intent along its northern borders (Estonia, Latvia, Lithuania) including cell/communication tower tampering. Could the recent Zapad exercises be more than just wargaming?

Some What If thoughts on these non-linear actions:

– Testing capabilities, distance, strength, impacts
– Testing responses like a stone in pond
    – 2nd and 3rd order effects were measured to determine the impact on targets, targets responses, etc.
    – Russians had people in each target country assisting with target impacts
    – Russians monitored target government communications from within each country
    – Determine length of time for target government to respond and what methods were used and where to get communications back online (if at all) – the locations of the response represent capabilities unknown to Russia until such an exercise is performed
– Other possibles:
     – A cover for illegal activities that occurred during the exercise – a feint, a ruse
 – Testing a precursor to actual execution – that is why military exercises are performed
 – What capabilities are being left in the exercise areas; what is not being removed after the exercise using the exercise as a ruse to place assets close to Western borders that were not there before
 What do you think?
 https://uawire.org/news/media-belarusian-and-russian-militaries-are-jamming-mobile-communications-along-border-with-poland

Featured post

Valery Vasilevich Gerasimov – Валерий Васильевич Герасимов

Chief of the General Staff of the Armed Forces of the Russian Federation / First Deputy Minister of Defence of the Russian Federation, General of the Army._64031862_gerasimov

Валерий Васильевич Герасимов

Born      8 September 1955 (age 62)

Kazan, Tatar Autonomous Soviet Socialist Republic

Married – one son

Russian hackers reportedly stole NSA data via Kaspersky Lab software

http://algo.fyi/5vhjug

Born on 8 September 1955 in the city of Kazan. In 1977, he graduated from the Kazan Higher Tank Command School named after the Presidium of the Supreme Soviet of the Tatar ASSR (Autonomous Soviet Socialist Republic). He commanded platoon, company, battalion in the Northern Group of Troops and Far Eastern Military District.

vg

After his graduation from the Military Academy of Armored Troops named after Marshal of the Soviet Union R.Ya. Malinovsky in the year of 1987, he served as the chief of headquarters and commander of tank regiment, the chief of headquarters of motorized rifle division in the Baltic Military District. From 1993 to 1995 — the commander of motorized rifle division in the North-Western Group of Troops.

After graduating from the Kazan Higher Tank Command School Gerasimov was the commander of a platoon, company, and battalion of the Far Eastern Military District. Later he was chief of staff of a tank regiment and then of a motorized rifle division in the Baltic Military District. From 1993 to 1995 he was the commander of the 144th Guards Motor Rifle Division in the Baltic Military District and then the North-Western Group of Forces.

After he graduated from the General Staff’s academy he was First Deputy Army Commander in the Moscow Military District and commander of the 58th Army in the North Caucasus Military District during the Second Chechen War. His involvement in the arrest of Yuri Budanov led to praise from journalist Anna Politkovskaya.

g3In 2006, he became commander of Leningrad Military District and moved to be the commander of Moscow Military District in 2009 and Central Military District in April 2012. On 23 December 2010, he became deputy Chief of the General Staff

In 1997 after his graduation from the Military Academy of the RF Armed Forces’ General Staff, he served as the First Deputy Commander of Army in the Moscow Military District, the Deputy Commander, Chief of Staff and Commander of the 58th Army in the North Caucasian Military District.

From 2003 to 2005 — the Chief of Staff of the Far Eastern Military District. From 2005 — the Chief of the Main Administration of Combat Training and Troops’ Service of the RF Armed Forces, and from December 2006 — the Chief of Staff of the North Caucasian Military District.vg4.png

In December 2006, he was assigned as the Commander of the Leningrad Military District, and in February 2009 — as the Commander of the Moscow Military District.

From December 2010 — the Deputy Chief of the General Staff of the Armed Forces of the Russian Federation.

From 26 April 2012 — the Commander of the Central Military District.

Gerasimovs-linjal

03-02By the RF Presidential Decree of 9 November 2012, he has been appointed the Chief of the General Staff of the Armed Forces of the Russian Federation / First Deputy Minister of Defence of the Russian Federation. He was appointed by President Vladimir Putin on 9 November 2012. Some authors credit Gerasimov as the person behind a so-called “Gerasimov doctrine” – currently prevalent in Russian military strategy – combining military, technological, information, diplomatic, economic, cultural and other tactics, which are then deployed towards one set of strategic objectives. This “political warfare” is preferred due to its comparatively low cost.

vg2

The previous Chief of General Staff, Army General Nikolay Makarov, was seen as close to Serduykov and was seen by commentators as likely to be replaced by new Defence Minister Sergey Shoygu. It has been reported that Makarov resigned, but he was formally dismissed by President Vladimir Putin. Other changes were the dismissal of Alexander Sukhorukov from the position of First Deputy Defence Minister and his replacement by Colonel General Arkady Bakhin, formerly commander of the Western Military District. Aerospace Defence Forces commander Colonel General Oleg Ostapenko was also promoted to Deputy Defence Minister. He was promoted to the highest rank in the Russian Army, General of the Army as of 2014. On September 15, 2016, he and Turkish chief of staff General Hulusi Akar conducted a

03-03

meeting on the future of Syria in the Ankara headquarters of the army. That meeting will result in tightened dealings between Russia and Turkey.

There is an old Soviet-era rhetorical device that a ‘warning’ or a ‘lesson’ from some other situation is used to outline intent and plan. The way that what purports to be an after-action take on the Arab Spring so closely maps across to what was done in Ukraine is striking. Presenting the Arab Spring–wrongly–as the results of covert Western operations allows Gerasimov the freedom to talk about what he may also want to talk about: how Russia can subvert and destroy states without direct, overt and large-scale military intervention. However, the assumption that this is a Western gambit primarily does appear genuinely-held. https://inmoscowsshadows.wordpress.com/2014/07/06/the-gerasimov-doctrine-and-russian-non-linear-war/

image_f02f46e5-5865-43de-957e-a19b266b57fb20170903_133742

VPK_08_476

In April 2014 Gerasimov was added to the list of persons against whom the European Union introduced sanctions “in respect of actions undermining or threatening the territorial integrity, sovereignty, and independence of Ukraine.”

Hero of the Russian Federation.

Personal decorations: Order for Military Merits, Order for Merits to the Fatherland 4th grade, Order for Service to the Homeland in the USSR’s Armed Forces 3rd grade, Order of St. George 4th grade, Order for Merits to the Fatherland with Swords 3rd grade, Order for Honor.

The role of nonmilitary means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness.

For me, this is probably the most important line in the whole piece, so allow me to repeat it: The role of nonmilitary means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness. In other words, this is an explicit recognition not only that all conflicts are actually means to political ends–the actual forces used are irrelevant–but that in the modern realities, Russia must look to non-military instruments increasingly. https://inmoscowsshadows.wordpress.com/2014/07/06/the-gerasimov-doctrine-and-russian-non-linear-war/

 https://warontherocks.com/2016/03/russian-hybrid-warfare-and-other-dark-arts/

 

 

 

Featured post

Blog at WordPress.com.

Up ↑

%d bloggers like this: