Information Technology

Social media research group Graphika said today it identified a Twitter botnet of around 3,000 bots that pushed pro-Chinese political spam, echoing official messaging released through state propaganda accounts.
Graphika said it was able to identify the botnet due to a quirk shared by the vast majority of bot accounts, most of which used quotes from Bram Stoker’s Dracula book for the profile description and the first two tweets.
Image: Graphika
Graphika said the Dracula botnet, as they named this cluster of fake accounts, exhibited multiple similarities to past Twitter botnets that were part of Spamouflage — a codename the company has given to the Chinese government’s social media influence operations, which Graphika had previously exposed in September 2019, April 2020, and August 2020.
However, unlike previous operations, the Graphika team discovered this botnet early, with the botnet only managing to amass 3,000 accounts, and with the oldest accounts dating back only one month, to July 2020.
Graphika said the accounts were not dangerous in themselves, as they appeared to be automated, either quoting Dracula or replying to each other’s tweets. However, the company said the accounts were used to amplify tweets and get predetermined topics trending, topics that could have been used to promote Chinese state propaganda, usually depicting a skewed view of reality, favorable to Beijing’s international affairs.
The botnet has been down since August 20, according to Ben Nimmo, a Graphika investigator.
In a blog post today, Nimmo said Twitter intervened and suspended the vast majority of Twitter Dracula botnet accounts, while also marking the others that were not taken down as “restricted,” preventing them from posting new content.
At the time of writing, it remains unclear if the accounts were suspended programmatically by Twitter’s algorithm, or if Twitter’s staff had also spotted the same botnet and manually intervened. A Twitter spokesperson did not return a request for comment seeking additional details and an official statement. More

Social media research group Graphika said today it identified a Twitter botnet of around 3,000 bots that pushed pro-Chinese political spam, echoing official messaging released through state propaganda accounts.
Graphika said it was able to identify the botnet due to a quirk shared by the vast majority of bot accounts, most of which used quotes from Bram Stoker’s Dracula book for the profile description and the first two tweets.
Image: Graphika
Graphika said the Dracula botnet, as they named this cluster of fake accounts, exhibited multiple similarities to past Twitter botnets that were part of Spamouflage — a codename the company has given to the Chinese government’s social media influence operations, which Graphika had previously exposed in September 2019, April 2020, and August 2020.
However, unlike previous operations, the Graphika team discovered this botnet early, with the botnet only managing to amass 3,000 accounts, and with the oldest accounts dating back only one month, to July 2020.
Graphika said the accounts were not dangerous in themselves, as they appeared to be automated, either quoting Dracula or replying to each other’s tweets. However, the company said the accounts were used to amplify tweets and get predetermined topics trending, topics that could have been used to promote Chinese state propaganda, usually depicting a skewed view of reality, favorable to Beijing’s international affairs.
The botnet has been down since August 20, according to Ben Nimmo, a Graphika investigator.
In a blog post today, Nimmo said Twitter intervened and suspended the vast majority of Twitter Dracula botnet accounts, while also marking the others that were not taken down as “restricted,” preventing them from posting new content.
At the time of writing, it remains unclear if the accounts were suspended programmatically by Twitter’s algorithm, or if Twitter’s staff had also spotted the same botnet and manually intervened. A Twitter spokesperson did not return a request for comment seeking additional details and an official statement. More

Pros
✓Excellent day and night vision
✓Solar panel charger
✓Pan, tile, and zoom functionality

Cons
✕Flimsy plastic camera mounting bracket

The Reolink Argus PT security camera is nice and compact, and just the thing you need for your small office security. It can pan up to 355 degrees to give you almost complete coverage and tilt 140 degrees vertically to give the optimum view of your space.
The camera is solid and well built and heavy in the hand. It looks rugged and is rated at IP65 is weather-proof for all the rain or dust storms that the weather can throw at it. 
Eileen Brown
The camera can be mounted upside down or on a wall and delivers good 1080p images even in dim light with its Starlight image CMOS sensor.
I found the plastic mounting bracket to be really flimsy and the plastic would bend if I flexed it.
I am sure that a blow with something solid would easily remove the camera from its plastic mount.
I did not trust the mount, so I fashioned a flat piece of aluminum bar and used a standard tripod mount thread to fix it securely to the wall.
Top ZDNET Reviews

The solar panel for the Argus PT camera comes in a different box.
At just over 7 inches in length and 4.5 inches wide, it is reminiscent of an iPad mini. It has a long cable with a micro USB plug to connect to the camera and a mount.
The solar panel mount is metal and very well constructed — a far higher standard than the Argus PT mount itself. It mounts on any surface using the reasonably sized screws provided in the box.
Undo the locking collar, adjust the solar panel in any direction to catch the maximum sun rays, and tighten up the collar on the mount to secure the panel. If it needs to use its onboard 6500mAh battery, it will still record images after several dull days with little solar charge.

Eileen Brown
It was really simple to connect the camera to the app. Like the Netvue cameras, install the Reolink app, scan the QR code on the bottom of the camera, and connect to Wi-Fi.
Place the QR code generated on the app near the camera and connect the camera to the app. If you prefer, you can download the desktop software directly from Reolink for your desktop device.
The camera uses motion detection to preserve its battery. It is not switched on permanently.
Depending on the sensitivity settings, it will view movement up to 33ft with low sensitivity, 40ft on medium, and 52ft on high.
You can reduce false alarms by turning the camera away from bright lights, moving cars, air conditioner outlets, and foliage that will flutter in strong winds.
Unlike the Netvue Vigil camera, you can not set zones that the camera will ignore. Instead, you need to pan and tilt the camera to make sure that these areas are not captured by the camera.
When the camera detects movement, it saves an image and alerts you that there is movement in the area. You can define a schedule so you will not be alerted when you are out and about during the day.
The app lets you talk through the camera, pan, tilt and zoom, and playback the video. You can view 8,15, and 30 seconds of video notification.
All in all, the Reolink Argus PT security camera is a neat, well put together camera with a range of cool features. It is well worth the sub $160 price tag for peace of mind.

ZDNet Recommends More

A browser fingerprinting script is a piece of JavaScript code that runs inside a web page and works by testing for the presence of certain browser features.
Today, browser fingerprinting is commonly used by online advertisers as a next-gen user tracking mechanism. Advertisers run different types of fingerprinting operations, create one or more “fingerprints” for each user, and then use them to track the user as he/she accesses other sites on the internet.
Because of the privacy-intrusive way that online advertisers are currently using browser fingerprinting, several browser makers like Firefox, Chrome, Opera, Brave, and the Tor Browser, have deployed features to detect and block these types of malicious code.
10% of the Top 100,000 Alexa sites use fingerprinting scripts
In an academic paper published earlier this month, a team of academics from the University of Iowa, Mozilla, and the University of California, Davis, has analyzed how popular browser fingerprinting scripts are used today by website operators.
Using a machine learning toolkit they developed themselves and named FP-Inspector, the research team scanned and analyzed the top 100,000 most popular websites on the internet, according to the Alexa web traffic ranking.
“We find that browser fingerprinting is now present on more than 10% of the top-100K websites and over a quarter of the top-10K websites,” the research team said.

Image: Iqbal et al.
However, the research team also points out that despite the large number of websites that are currently using browser fingerprinting, not all scripts are used for tracking. Some fingerprinting scripts are also used for fraud detection since automated bots tend to have the same or similar fingerprints, and fingerprinting scripts are a reliable method of detecting automated behavior.

Image: Iqbal et al.
Academics discover new fingerprinting techniques
But the research team also analyzed which browser or JavaScript API features the scripts were trying to fingerprint.
“Our key insight is that browser fingerprinting scripts typically do not use a technique (e.g., canvas fingerprinting) in isolation but rather combine several techniques together,” researchers said.
Researchers said they identified clusters with recurring fingerprinting techniques but also clusters that contained new techniques, which were previously unreported as potential fingerprinting avenues, suggesting that companies are actively investing in discovering new ways to track users based on their browser’s footprint.
Below is a summary of some of the new fingerprinting techniques researchers discovered:
Permissions fingerprinting- Researchers said some websites probed the browser Permissions API to determine whether a permission was granted or denied by the user. Academics said they found specific cases were fingerprinting scripts had probed if the user had granted a website Notification, Geolocation, and Camera access, and were using this information to track the user.
Peripheral fingerprinting – Researchers said they also found scripts probing if websites had received access to connect to gamepads and virtual reality devices, and were using this info to track users. In other cases, some websites were fingerprinting users via their keyboard layout, typically exposed via the browser’s getLayoutMap function.
API fingerprinting – Researchers said that some websites probed if the user’s browser had specific APIs enabled. For example, some fingerprinting scripts checked for the AudioWorklet API (specific to Chromium browsers only), while others checked if certain JavaScript functions like setTimeout or mozRTCSessionDescription were overridden by extensions.
Timing fingerprinting – Researchers said they also found that some fingerprinting scripts measured the time that took for certain functions to execute. For example, some websites used the Performance API to track when events like domainLookupStart, domainLookupEnd, domInteractive, and msFirstPaint were taking place during a predefined operation.
Animation fingerprinting – This category is one of the most common fingerprinting methods today, but researchers said they found new ways that websites were abusing the AudioContext API.
Sensors fingerprinting – Just like web animation-related functions, sensors have been heavily abused in fingerprinting scripts, but the research team said they found websites that probed for the little-known userproximity sensor.
Additional details about the team’s research can be found in a paper named “Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors,” set to be presented at the IEEE Symposium on Security and Privacy, next year, in May 2021.
The research team also said it reported the list of domains that hosted fingerprinting scripts discovered via FP-Inspector to Easylsit/EasyPrivacy and Disconnect, two projects that manage so-called “blocklists,” which are list of domains that can be loaded inside ad blockers.
Users who consider this research paper concerning can block fingerprinting scripts by enabling anti-fingerprinting protections in their respective browser settings or by installing an ad blocker extension. More

Security firm Bitdefender said it discovered what appears to be a new hacker group that is currently targeting companies across the globe with malware hidden inside malicious 3Ds Max plugins.
3Ds Max is a 3D computer graphics application developed by software giant Autodesk and is an app commonly installed and used by engineering, architecture, gaming, or software companies.
Earlier this month, on August 10, Autodesk published a security alert about a malicious plugin named “PhysXPluginMfx” that abused MAXScript, a scripting utility that ships with the 3Ds Max software.
The security advisory warned users that, if loaded inside 3Ds Max, the PhysXPluginMfx plugin would run malicious MAXScript operations to corrupt 3Ds Max settings, run malicious code, and propagate and infect other MAX files (*.max) on a Windows system, and help the malware spread to other users who received and opened the files.
Bitdefender, which took a closer look at this exploit in a report published today, said the purpose of this plugin was, in reality, to deploy a backdoor trojan that hackers could use to scour infected computers for sensitive files and later steal important documents.
Image: Bitdefender
The Romanian cybersecurity firm also said it investigated and was able to confirm attacks against at least one target, an international architectural and video production company, currently engaged in architectural projects with billion-dollar luxury real-estate developers across four continents.
Information gathered during this investigation revealed that hackers used a malware command and control (C&C) server that was located in South Korea.
“When looking at our own telemetry, we found other samples that communicated with the same C&C server, which means that the group was not limited to only developing samples for the victim that we investigated,” Liviu Arsene, Bitdefender Senior E-Threat Analyst, told ZDNet in an email.
Per Bitdefender, these additional malware samples initiated connections to the C&C server from countries such as South Korea, United States, Japan, and South Africa, suggesting that the hacker group might have also made other unconfirmed victims in these countries as well.
These connections go back for at least one month, but as Arsene told ZDNet, this doesn’t mean the hacker group started operating one month ago, and hackers could have very easily used another server for older operations.
“If the sophistication of this investigated attack is any indication, they seem to have a firm grasp of what they’re doing and could have been flying under the radar of security specialists for some time,” Arsene said.
While details about the group’s entire operations and hacking spree are still shrouded in mystery, Bitdefender researchers appear to believe that this group is yet another example of a sophisticated hacker-for-hire mercenary group that is renting its services to various actors, for the purpose of industrial espionage.
While the Bitdefender report doesn’t contain the information to support this assessment, if true, this would make this group the third hacker-for-hire group exposed this year after Dark Basin (Indian company BellTrox; targeted politicians, investors, and non-profits) and DeathStalker (previously named Deceptikons; targeted European law firms).
The Bitdefender report is also the second report where hackers created malware for an Autodesk software program. In November 2018, security firm Forcepoint discovered an industrial espionage hacker group who targeted companies in the energy sector with AutoCAD-based malware. Arsene said Bitdefender was not able to find any evidence linking these two hacking campaigns/groups. More

Image: Asha Barbaschow/ZDNet
The current architecture of the intelligence world is full of historical accidents dating back to the Second World War, says Andrew Davies, a senior fellow at the Australian Strategic Policy Institute (ASPI) in Canberra.
Take all the cybers, for example. In most western countries both cyber intelligence and cybersecurity have ended up being run by the signals intelligence agencies.
The Australian Cyber Security Centre is part of the Australian Signals Directorate, for example. In the UK, the National Cyber Security Centre is part of their signals intelligence agency, the Government Communications Headquarters.
According to Davies, if you started with a blank sheet of paper you wouldn’t necessarily do it that way
Digital espionage has “been the leader” in the agencies’ adaptation to the internet age, he said, but the increasingly important areas of subversion and information operations look more like state-on-state hostile actions.
“The age-old game of subversion has now become something that can be done much more effectively, and with much deeper reach into somebody else’s population,” Davies said in a panel discussion last week.
“One of the things that the intelligence community is probably undercooked on is the sort of foreign influence, the sort of things that we saw Russia doing during the US presidential election and elsewhere in Europe in various elections, and the Brexit poll, for example,” he said.
“One of the problems the intelligence community has is that there’s not a great incentive on the behalf of the political entities that benefit from that influence to do much about it.”
In the US, for example, the Trump administration “has not exactly been on the front foot” in limiting the ability of future influence operations.
At the same time, Davies said, the levels of trust between the intelligence community and government have declined.
“Governments these days, for whatever reason, they’re much more convinced that they understand the world better than experts do,” he said.
“You only need to look at the climate change policies of most of the countries of the world to see that.”
There’s “a fair amount of circumstantial evidence” that the intelligence community gave plenty of warning about the coronavirus outbreak in Wuhan to the US government, Davies said, and presumably through the Five Eyes alliance to the UK and Australia.
“Yet two, three months later, governments were still scrambling to make things up as they went [along], which suggests that the warnings of intelligence agencies were not well taken on board,” he said.
“If I had to sum it up, I’d say that the biggest challenge is establishing credibility and trust with governments to provide that expert advice in a world where it’s now, I think, easier for adversaries to reach deep inside your society and foment distrust.”
Greater powers require greater oversight
Davies was a contributor to the latest edition of Australian Foreign Affairs, titled Spy vs Spy: The New Age of Espionage, for which last week’s panel was the launch.
In his essay, he notes that “regulation in the first few decades of Australian intelligence was much lighter than today”. Indeed, the agencies weren’t even publicly acknowledged until the 1970s, and there was “no significant independent oversight”.
Over the decades, that oversight has been improved by creating an independent Inspector-General of Intelligence and Security in 1986 and passing the Intelligence Services Act 2001.
But the agencies and their powers have also grown. Massively.
In 2001, ASIO’s budget was AU$61 million, for example, which is around $94 million in today’s money. But its budget now is AU$573 million.
Changes are needed, says Senator Penny Wong, the Shadow Minister for Foreign Affairs and a former member of the Parliamentary Joint Committee on Intelligence and Security.
“We need to consider whether or not how we operate as a polity, both in the intelligence architecture and culture and priorities, reflects the risks that Australia actually faces,” Wong said.
“Additional powers for intelligence and security entities ought to be accompanied by additional oversight.”
Wong is also worried about the way the public discussion of trade and security issues with China has been conducted.
“It is a difficult, complex-ish set of issues that we face as a nation in terms of the bilateral relationship and more broadly,” she said.
“I think we will benefit from very clear, consistent leadership in terms of the public discussion and from our political leaders.”
Australia also needs to tackle “something that has been neglected and misunderstood for a long time”, which is what China calls United Front Work and Australia has defined as “political interference”.
“It’s kind of a tricky one, because that one involves a mix of people who are professional employees of the Chinese state, and people who are sometimes working as business people and sometimes doing other stuff as well,” Wong said.
According to Professor Anne-Marie Brady, a specialist in Chinese politics, western nations need to understand the Chinese Communist Party (CCP) and its institutions in their own terms.
“We should have the same kind of basic knowledge across politicians and journalists and academics [about] the CCP intelligence agencies, as well as the other structures within the CCP system, as we do have that broad general knowledge and awareness about, say, the CIA or the FBI, or the KGB and FSB,” Brady said.
“We need to popularise that knowledge,” she said.
The rise of HUMINT-enabled cyber operations
While cyber espionage has certainly gained attention in recent years, Davies says the role of humans and human intelligence (HUMINT) won’t disappear.
“In almost any endeavour that people are involved in, the weakest link in the system is often a human being,” he said.
“Much more often, what a HUMINT operation looks like is an agent recruiting somebody within a foreign country, within the foreign government, within an organisation such as the IRA [Irish Republican Army] or even al Qaeda to act as a conduit of information, to exfiltrate information to the outside, and that won’t go away.”
Even the archetypical cyber sabotage operation, the Stuxnet attack on Iran’s uranium enrichment program revealed in 2010, probably involved a person with physical access to the controlling computer systems.
“People can actually act as an enabler for cyber as well,” Davies said.
These new ways of doing things will require a different skillset, panellists said.
ASPI’s Danielle Cave said she’s worried about recruitment, not just in the intelligence community, but also in the Department of Foreign Affairs and Trade, Home Affairs, and “the whole sort of foreign affairs and security space”.
“When I meet new people coming into different departments and agencies, I’m shocked by how little those people are different from the people I met 15, 20 years ago,” she said.
“There’s a lot of scope to go out and attract people in, and go poach talent from all different kinds of places.”
Cave analysed the Australia-US Ministerial Consultations communique for 2020 and compared it to the communique from 2010. The language has changed considerably.
“The number of times technology was mentioned went from once in 2010 to nine times this year,” she said.
The word “critical”, in the context of critical technologies, critical infrastructure, critical minerals, rose from zero to 10. Also up were mentions of information, disinformation, interference, cyber, resilience, and, of course, 5G.
Wong said that reflects the new landscape we face.
“What you want in the foreign affairs department is a much greater expertise across a number of the domains you’re describing,” she said.
“Otherwise that institution simply won’t be effective, either in government or in terms of advocating Australia’s national interests.”
Related Coverage
China’s influence via WeChat is ‘flying under the radar’ of most Western democracies
China’s United Front Work Department performs its ‘biggest magic’ through WeChat. Is it time to rein in its covert influence? Should it even be banned?
US adds 11 more Chinese companies to entity list for Uyghur human rights violations
Among the sanctioned companies is a camera part supplier for Apple.
Experts renew calls for a government body to tackle foreign disinformation
Select Committee hears testimony that no one in government thinks they own the problem of countering misinformation on social media.
ASPI wants statutory authority to prevent foreign interference through social media
It said the authority would be granted explicit insight into how content is filtered, blocked, amplified, or suppressed, both from a moderation and algorithmic amplification point of view. More

The New South Wales government has announced an investment into the state’s cybersecurity capabilities, hoping to use AU$60 million to create an “army” of cyber experts.
With the funding to be spread over three years, Minister for Customer Service Victor Dominello said the creation of a cyber army would see the scope of Cyber Security NSW broadened to incorporate small agencies and councils.
Cyber Security NSW was stood up in mid-2019 to consolidate and lift the cyber capability of state entities.
“The AU$60 million is not only a four-fold increase in spending on cybersecurity but allows Cyber Security NSW to quadruple the size of its team in the battle against cyber-crime,” Dominello said.
“Cyber Security NSW will train the next generation of cybersecurity experts and ensure there is a cross-government coordinated response, including advance threat intelligence sharing, cybersecurity training, and capability development.”
The funding was made available through a AU$240 million commitment made in June to improve NSW’s cybersecurity capabilities, which included investments towards protecting existing systems, deploying new technologies, and increasing the cyber workforce.
Under that commitment, Dominello previously announced standing up a cybersecurity vulnerability management centre in Bathurst, 200km west of Sydney.
To be operated by Cyber Security NSW, the centre will be responsible for detecting, scanning, and managing online vulnerabilities and data across departments and agencies. 
In June, Dominello also called for submissions to help shape the state government’s 2020 NSW Cyber Security Strategy. The plan will be aimed at developing a “comprehensive, sector-wide cybersecurity strategy”, one that supersedes the existing 20-page strategy that was published in late 2018.
“The new strategy will be delivered through an integrated approach to prevent and respond to cyber security threats and safeguard our information, assets, services, businesses, and citizens,” Dominello said at the time.
The federal government earlier this month published its own cybersecurity strategy, which included the Commonwealth vowing to: Develop legislation that would impose cyber standards on operators of critical infrastructure and systems of national significance; consider what laws need to be changed to have a minimum cyber baseline across the economy; and create powers that allow the federal government to get on the offensive and actively defend networks and critical infrastructure.
The strategy followed the announcement of the Cyber Enhanced Situational Awareness and Response (CESAR) package that will see the federal government spend AU$1.35 billion over a decade on the nation’s security agencies. Around AU$470 million will be used to create 500 cyber-related jobs within the Australian Signals Directorate (ASD).
Beyond CESAR, the federal government has put forward another AU$320 million in funding under the strategy.
During a recent hearing into the cyber resilience of Commonwealth entities, ASD was asked if any of the cyber funding, including from the 2020 Defence Strategic Update, would be put towards ensuring such entities are compliant with the Top Four mitigation strategies.
ASD said in response to questions taken on notice that it would continue to conduct cyber uplift initiatives similar to what it has previously run as part of the AU$1.35 billion dollar investment in cybersecurity.
“As announced through the Defence 2020 Force Structure Plan, AU$15 billion will be invested by the Defence Portfolio (including the Australian Signals Directorate) for cyber and information warfare capabilities in over the next decade,” it said.
“This includes the recently announced investment of AU$1.35 billion over 10 years from 2020-21 to enhance and continue initiatives focussed on national situational awareness of cyber threats, disrupting cyber criminals offshore, and building partnerships with industry and government which enhance national cyber resilience.”
Also provided on notice by the ASD was the admission that it hasn’t conducted any bug bounty programs in Australia, despite such initiatives resulting in more than 10,000 vulnerabilities being discovered since 2016 in the United States.
“ASD operates in line with the Responsible Release Principles for Cyber Security Vulnerabilities, which are available at asd.gov.au,” it said in response to a question asking if the government considered the adoption of bug bounty programs for Commonwealth government agencies. 
“In line with these principles, ASD engages actively with the information technology research community and industry who disclose vulnerabilities to ASD.”
RELATED COVERAGE More

special feature

Securing Your Mobile Enterprise
Mobile devices continue their march toward becoming powerful productivity machines. But they are also major security risks if they aren’t managed properly. We look at the latest wisdom and best practices for securing the mobile workforce.
Read More

The US Department of Justice announced charges today against a Russian citizen who traveled to the US in order to recruit and convince an employee of a Nevada company to install malware on their employer’s network in exchange for $1,000,000.
According to court documents unsealed today, Egor Igorevich Kriuchkov, a 27-year-old Russian, was identified as a member of a larger criminal gang who planned to use the malware to gain access to the company’s network, steal sensitive documents, and then extort the victim company for a large ransom payment.
To mask the theft of corporate data, Kriuchkov told the employee that other members of his gang would launch DDoS attacks to keep the company’s security team distracted.
Kriuchkov and his co-conspirators’ plans were, however, upended, when the employee they wanted to recruit reported the incident to the FBI.
FBI agents kept Kriuchkov under observation during his stay in the US, and eventually arrested the Russian national on Saturday after they had gathered all the evidence they needed to prosecute.
Below is a chronological timeline of Kriuchkov’s time in the US and his attempts to recruit the insider, along with additional commentary, where needed. All events took place in 2020.
July 16: Kriuchkov contacts the employee working at the Nevada company via a WhatsApp message and informs him of his plans to visit the US. The employee, identified in court documents as CHS1, told the FBI he knew Kriuchkov from contact the two had years before, in 2016.
July 28: Kriuchkov arrives from Russia in New York, travels to San Francisco, and then to Reno.
August 1: Kriuchkov makes contact with CHS1 via phone.
August 2 and August 3: Kriuchkov, CHS1, and friends travel to Emerald Pools and Lake Tahoe, where Kriuchkov pays for everyone’s expenses while also trying to avoiding having his picture taken.
August 3: During the last day of the trip, at a bar late at night, Kriuchkov tells CHS1 he works for a group on “special projects” through which they pay employees for installing malware on their employers’ networks. Kriuchkov then details the entire scheme to CHS1 and says that the malware could be provided on a USB thumb drive or sent to him via email. Initially, Kriuchkov told the employee he’d be paid only $500,000 for installing the malware, and that his gang would launch a DDoS attack to disguise the data exfiltration process.
Following this proposal, CHS1 reports Kriuchkov to the FBI, and future meetings are kept under surveillance.
August 7: Kriuchkov has another meeting with CHS1. During this meeting, Kriuchkov attempts again to convince CHS1 to participate in the scheme, this time claiming that his group has been orchestrating these “special projects” for years and that all other employees who cooperated were never caught and still work for their employers. Kriuchkov also suggests that his gang can make the malware infection appear as it originated from another employee if CHS1 had anyone in mind they wanted “to teach a lesson.” During this meeting, CHS1 also asks for a $1,000,000 payment, including $50,000 upfront.
August 17: In another meeting, Kriuchkov reveals more details about the gang he works, including the fact that they handle payments using escrow via “Exploit,” the name of a well-known hacking forum. Kriuchkov also reveals he recruited at least two other employees, with one of the previous victim companies paying a $4 million ransom following a successful hack. Kriuchkov and CHS1 also had a WhatsApp call with a member of Kriuchkov’s gang and talked payment and escrow details. Kriuchkov also claimed that a member of the group is an employee at a government bank in Russia and that the group paid $250,000 for the malware, which was written specifically for CHS1’s company. Kriuchkov left a phone with CHS1 so he could get in contact in the future.
August 18: In a subsequent meeting, Kriuchkov tells CHS1 that the gang refused to pay him an upfront fee, as they have never done so before; however, they agreed to the $1,000,000 payment. Kriuchkov said his own cut was reduced to $250,000 following CHS1’s demands. Kriuchkov also told CHS1 that he would need to provide details about his employer’s network to the gang in order to customize the malware.
August 19: Kriuchkov met with CHS1 and said the gang eventually agreed to an upfront payment of 1 bitcoin.
August 21: Kriuchkov meets with CHS1 to inform him the “special project” was delayed due to another ongoing “special project” for which the gang expected a huge payout and needed to focus their efforts. Kriuchkov also told CHS1 he was leaving the US and then left instructions with CHS1 detailing how he would be contacted by gang members in the future.
Following this meeting, an FBI agent contacts Kriuchkov by phone, who then attempts to hastily leave the country and is eventually arrested the next day in Los Angeles.
Kriuchkov was charged on Monday and faces up to five years in prison for his role in the scheme, if found guilty. More