09 - Three Paths of Hacktivism: Russia, Ukraine and Belarus

You can see activism off we go. Who am I? I spend a whole lot of time in Russia doing a whole lot of relatively sketchy things, but uh in Canada. So, what are we going to be talking about today? First, we're going to be baselining ourselves with political theory. I know that's exactly what you want at a cyber security conference. Then, uh we're going to talk more about the individual threats on a country bycountry basis. And then we go back to political theory just a little bit. And then we look at how that gets exported from Eastern Europe everywhere else into the in the world. So let's baseline what is these are the definitions that

we're going to be working with. So activism you probably all know what it is organic technically minded activism using cyber enabled means. Okay great awesome. Then we're going to go into our ideology. What drives activism? that idea or theory behind that belief or system that could be literally anything and it is not necessarily just political. It can be things for example environmental or religion or anything of that sort. Uh then we go down to the system of governance something very very important to the idea behind this talk. What is that form of governance and how does it work in the country in the target country in practice but not based on its constitution and that's going to

be very very important in just a second. Finally, an existential threat. What is it? Well, an existential threat is basically is there a risk or a threat to an idea, a system, a person, an entity, literally anything in the world that it will no longer exist if things happen. Again, a very important element to this talk. So, the forms of governance as I as you saw in the title of the talk, we got three case studies. Russia, Ukraine, Bellarus. So, what is Russia? That is a managed democracy. Constitutionally they say it's a democracy but well when you have an election and 99% votes for Ramsan Kaderov that is absolutely not man not that is absolutely managed.

Uh they are autocratic shocker. uh they are surveillance state again what a shock you have a system called SARM that is a legal intercept tool that all telecoms in the country must have installed and the state is able to see absolutely anything and everything that is not encrypted in the country fair democratic absolutely uh they have an exiled opposition so people like uh Julia Naya um Vladimir Ketamoza they have left the country more or less under threat of death as Alexi Noni bravely found out. Uh but they have lost touch with the people at home because they hold their rallies. Go Ukraine down with Putin. How do we change the country? Well, they don't really know because

they aren't there and they've lost the touch with the people that they themselves claim to represent. Finally, there's a social contract that existed for quite a while where the Kremlin got to do whatever it wanted as long as the people got to go to Turkey once a year. Prices were down and gas was cheap. Well, guess what? It's a little harder now. Now, on to Ukraine. They're a dem they're a democracy. I have is because I have certain issues with how the state of governance is. for example, bringing the uh trying to bring the anti-corruption police under political control of the presidency. To me, a little touch and go, but of all the countries that we're looking at today,

they are by far, hands down, the most democratic. They have one of the, in my opinion, strongest civil societies in the world, these people have braved the riot police, snipers, tanks, you name it. They've made their voices heard and affected change in their country. Their diaspora is probably the most patriotic in the world and they have surveillance state capacity but that's been shifted to the war effort. Uh Bellarus autocratic Lucanka is sort of jump says jump. Lucena doesn't even ask Kawaha. He just goes as high as he can. And they have an exiled opposition as well, similar to Russia, but theirs is still very much in touch with things that matter. And again, very much a surveillance state.

Now, why does this all matter? We're going to get there in now. So within Russia, we're going to do a little bit of a history lesson and go from the idea of a what is the history of state-run activism in Russia from the man on the uh left with the purple vest uh Vladislav Sakurov all the way to uh Sergey Kerenko the current these guys are very important because they all held the same position the first deputy chief of the presidential administration of the Russian Federation. Now, why do I care about this very obscure and very bureaucratic component of the Russian bureaucracy? Well, their focus is domestic policy. Again, why am I talking domestic policy at a security

conference? Well, Surkov, I'm uh is what I would call the granddaddy of both managed democracy and Russian activism. Now, why would I say Russian activism? Does anybody remember the Bronze Soldier crisis? You can thank the man in the purple vest with a love of Tupac and cocaine for the DOS attacks that crippled Estonia. his then predecessor uh not predecessor pardon me successor uh via Valen built the environment that uh yani progenian's internet research agency or the troll farms behind uh that were quite prominent during the uh first during Hillary Hillary Clinton's election run create uh sort of thrived in that comes down to volen's creation of the prisma uh and social media monitoring capacity that really started as a result of civil

society and uh Alexi Navali Botnay uh protests in 2011 when Putin announced his ability his re-entry to the presidency in effect. Finally, we have Sergey Kirinenko. A very interesting man, particularly because of his role in integration of the occupied territories in Ukraine along with the generation of the next the creation of the next generation of Russian technocrats. Now, that is youth policy to very much an extreme. He's creating the people who will be replacing Putin and the cadre that exists in its uh basically the post so the Soviet educated but came of age during the '9s cadre of leadership in Russia. Again, why in God's name am I talking about all of this at a security conference? Well,

Kieran Yenko created a very fun agency uh focused on youth social media monitoring and internet safety. We don't need to worry about that too much. But these people employ child psychologists, open source intelligence analysts, and they're based throughout the entirety of Russia with an focus on theoretically preventing things like say Coline from happening. But this same agency runs a little activist collective you may know as no-name05716 who doses anybody in globally for reasons that Kieran Yenko tells them. But what is very notice not notable about no-name is that they have gamified activism. Not only are you uh does an individual voluntarily enslave their device or devices however they want to do project but they get leaderboards there's merch.

There's you get paid in the most worthless cryptocurrency ever because one Dcoin is equal to one ruble. though you got to do a lot to make any form of money doing it. But they have effectively created a system similar to say League of Legends to create youth involvement, get people brought in. Now, there's some circles on this one. Those are the parts you sort of want to focus on. Those are all known activist personas that I can find that have been tied directly into the GRU. Now, why am I focusing on the GRU in this case? It's just really easy. They're not subtle. All this is publicly accessible information and it's been all these have

all been linked through say US government indictments of particular individuals. For example, Cyber Army Russia reborn two or three people that run that operation have been sanctioned by Canada, the US and the EU and have been tied directly into GRU Cyber Ops. And it sort of goes to this idea of the state runs activism in Russia. It's not organic. It goes against all concepts that we started talking about at the beginning where ideology and grassroots activism creates people or creates these personas in this activity. But in this particular instance, Russia is unique. Hence the three paths. We're going to go to this one and we see a whole bunch of people sitting around a table. This is

uh taken in the Kiev metro. Uh I think it was 2022, but this is sort of the IT army of Ukraine going and sticking it to the Russians. Just a bunch of kids got together, their country got attacked and well shove it Russia, we are going to go take down your systems. The sort of more true sense of grassroots activism. Now, since it started, since the war began, it has become blended with state functions. But part of that ends up effectively being, at least to my mind, how can Ukraine better utilize its smaller population to the best effect? So, you have the GRU of SVR, the FSB in Russia, massive organizations. You've also got huge

population difference for example between Russia and Ukraine. But they are able to attack at a far greater pace through state-run activity. Meanwhile, Ukraine's SBU HUR and their their own SVR, it's still the same acronym. Uh smaller, lower capac uh not necessarily lower capacity, but they got less people to do the same amount of work against a bigger target. So by out they can effectively blend the state and the civic, the state and the grassroots, the state and the volunteers. Let's go annoy the hell out of the Russians by dodosing anything and everything that they have. While amongst all of that, military intelligence, foreign intelligence can go and do proper intelligence collection, proper destructive and disruptive attacks in a similar vein to

Sandworm. Now, what's particularly notable about Ukraine is that they also get help from the outside, but that's going to be talked more about when we get to Bellarus. Then we get to defensive activism. This is something Ukraine is from every all the research that I can find, they have been doing exceptionally well since at the very least 2014. Case in point, the picture you'll see here, that's from 2014. So depending on who you ask, the war started in 2014 or 2013 with the annexation of Crimea. And this is from a now, I believe, defunct hack pro- Ukraine activist group uh Ukrainian cyber troops. It's from a random CCTV camera in uh somewhere in Daesco, but it highlights. Okay, well, we can

see Russian troop movement. Now, great, that's offensive, but now think of it, think of it in a different capacity. There's a camera back there. Is that open to the internet? somebody SVR hi Putin can take a look at me see me standing here talking about how Ukraine is ruining his day and something can happen down the road but they are able to get that view and the Ukrainians can say oh watch the same webcam if it's open to the internet anybody can get access to it they are using web uh the IT army of Ukraine in particular has been very proactive in cataloging open CCTV uh CCTV cameras, webcams, any IoT device effectively that has a camera

and go and providing it to their security services. Now, what does that hap how does how does that actually get utilized in defensive measure? Well, if the Russians if we found it that let's assume the Russians have what is visible from this webcam? Is there a military base, a logist a logistics hub? Is it just a gas station that everybody likes to stop at on the way to the front because they've got the best pies? Who knows? But that can guide, they can use that, the Russians, to guide a kinetic strike on that location and disrupt Ukraine's efforts to fight back. So that in and of itself create is like an incredibly to me novel technique.

Now I talked about how Ukraine gets some outside help. These guys are incredibly interesting. The Bellar Russian cyber partisans. They are an how the best way to describe them is almost the equivalent of if not equal to a state nexus threat actor that we have no idea who's funding them because they actively target their own country's government and they do not seem to take orders from the opposition, the exiled political leadership in Barus. Yet they in concert with a pro- Ukraine group, Silent Crows, I believe it was, took down the Russian flag carrier, Aeroflot, for three days, extracted a bunch of information and handed that stuff over to Ukrainian intelligence, particularly surrounding the use of Aeroflot's logistical

capacity to support the Russian war effort. They've also done similar to Bellarussian rails when the Russians were using uh Bellarus's rail network to move stuff to the uh to the front and they used offensive capabilities to take down train signals which ultimately disrupted the rail networks for the country. So these guys are also notable in that they deliberately triage all stolen data from Bellarus because as I said they actively target the regime. Their big thing is we're going to expose corruption and human rights abuses through cyber enabled means in the country. So if an individual were to be working for the KGB and in Barus and involved in uh the torture of dissident, well, this group would actively be going

after these people, doxing them and trying to get this person effectively blacklisted within the western world. Does it have a true does it have any real impact as many of these people don't actually leave Bellarus? No, not really. But it is putting that is that ideological mo component of this is our country. We will do anything in our power to improve it and this is how they are able to do it. But they don't have they don't seem to take any marching orders from any political masters if that makes any sense. Finally with these guys in all the data that they get because Barus is a surveillance state they triage it immensely so that if you are an average

citizen they go actively out of their way to not to ensure that your information remains as class as hidden as possible that you are not impacted and that is a remarkable difference from most activist groups which are more focused on we Got it? Well, now we're going to get it out there and whatever the consequences are, whatever the consequences are, who cares who's impacted, it fits our ideological path. So, I've talked a lot about Europe in a real fast manner. How do we get this outside of Europe? Where can this happen? So, three big areas that I think lots of people care about. China, Taiwan, and all the I have the US up there. So, China power vertical similar

to Russia. What are we going to be doing? Well, they like to do state-run inorganic things. Taiwan, very much like Ukraine in my mind, far more democratic. I believe in the event China crosses the straight, we would see a far greater surge in grassroot activity in the in cyerspace from Taiwanese individuals that are capable of doing so. And then finally, the US. We have a pretty divisive president there and a very capable information security community. What are they going to do? What could they do? Something similar to Bellarus. No political master but highly motivated and highly capable. And then you'll see that chart down below. This is just sort of a little overview of different ideologies that one can sort

of find globally. uh like so nationalism or indigenous rights environmentalism uh Islamist if you're focused primarily in the Middle East and then like that there's a whole bunch of ideologies. These are just sort of key drivers across the broader activist landscape that I found and sort of the key regions that lots of activist activity emerges from. Now, most of this still remains in these sort of low-level DDoS, web defacement, very basic hack and leak operations that have little to no impact and just don't really do anything. But that's because there's been a lack of existential threat and that is where this comes into effect. So in we take Turkey for example, say there's a Kurdish activist

group and they feel that well uh Ankura is about to wipe us off the face of the earth. We might start doing things a little more aggressively than we have been in the past because we don't have any we feel such a threat to our existence. Similar to how Ukraine they've stepped up their capacity quite a bit as a result of the war. Russia similarly their attack their capacity has changed. Bellarus these guys one there's one known person for the Bellar Russian cyber partisans and she lives in New York and she's their official spokesman. Everybody else hides behind immense security measures. Uh but since we are coming to the end, I will take questions. [applause]

Uh hello. Uh well, I I do I do appreciate the this the short class on posts Soviet uh political situation but I noticed that even though it's activism you I I feel it was mostly focused on state aligned and insurgents against the state like that along those lines but uh I feel like there there have been because are the fun like prominent groups like anonymous or lolk uh that I think are relevant are relevant to to this uh discussion and well like still a line it also mentioned like North Korea for instance when they went crazy against like Sony pictures because of the movie. So I'd like to what do you think about non-state aligned uh like anarchist or

more cause focus uh actors? So those groups are very much a thing and I don't the purpose of this is not to discount those groups in any capacity. The purpose of this one is to focus on a place where the TTPs utilized by activists have grown exponentially. LOL anonymous they primarily focus on your sort of low-level annoyance stuff your DOSs your web defacements you have say soul sepic which is one of the sandworm or GRU Russian GRU aligned activist groups. Well, that's a group that claimed that they took down uh Kievar, which is the biggest telecom in Ukraine, for example, and they took down their system. Like the company was inoperable for twoish days. The Bellar Russian cyber partisans took

down a flaw. The airline couldn't function for the better part of a week. It's a far different. It's a step up. And the purpose of this and the hypothesis that I effectively have hopefully tried to present is that an existential threat changes how a group operates. Anonymous I don't believe for example it's so unorganized so disassociated so global that anybody even the Russians have utilized the anonymous brand to hide their ops. So for example, Anonymous Poland and uh I think it was Anonymous Bulgaria have been groups that have utilized that branding got amplified in fact by the more generic general anonymous accounts but were utilizing that brand to promote their attacks if that makes sense.

So when a more lowlevel I'll say I say lowlevel but it's not that they're low level it's just that it's a non-state aligned group I guess I should say faces an existential threat much like with for example in this chart you so Latin America there's a whole bunch of groups ideologically focused environmentally focused uh they focus on things like environment and uh indigenous rights for example and they like to target Canadian companies because we mine there and we have historically been pretty bad at respecting both the environment and indigenous rights there. So they have conducted DDoS campaigns. There's been there's a whole off Canada that Anonymous has conducted surrounding our mining sector but it's remained at the DDoS level

whereas say when the Russians or when the Bellarus targeted uh Kievar Kstar Aeraflot or Russia targeted the unified and state reg uh unified and state registries of Ukraine under these personas it resulted in lasting more than 20 minute till uh your DOS measures kick in damage to the operational capacity of that organization. Does that make sense? Hi. How pervasive do you think um foreign individuals are in supporting these uh nationalist activists such as an American helping out Ukrainian activists? >> Very soe especially in the case of the IT army of Ukraine. Uh who did it? I think it might maybe it was the financial times. I don't remember which or news organization but like twoish

years ago uh they interviewed a Dutch guy who was one of the founding members of the IT army of Ukraine. Much like it comes down to what is an individual's capacity to support Ukraine. If somebody's pro- Ukraine and they have military training, many people in the Canadian armed forces for example went off and joined the Ukrainian military and in fact are fighting on the front lines as an in personal capacity. Similarly Americans Canadians Dutch even Russians uh help or work with the IT army of Ukraine because the concept of the IT army of Ukraine is not to be a purely Ukrainian entity. They have their own there are their own there are collectives within Ukraine that are

purely Ukrainian, but the IT army of Ukraine is a effectively a rallying place for foreigners to go join and assist. On the Russian side though, no, that's very it's very much you enlist and have fun. >> So, thank you very much, Yan, for that informative talk. >> [applause]