Experts dissect Russia's cybercriminal proxy model
Atlantic Council experts examine how Russia uses cybercriminal groups like Conti and Evil Corp as proxies for state cyber operations amid the Ukraine invasion.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This roundtable discussion features five cyber policy experts analyzing Russia's use of non-state actors—cybercriminal groups—as instruments of state cyber statecraft. Key examples cited include Conti's public pledge of allegiance to the Kremlin following the invasion of Ukraine, Evil Corp's leader Maksim Yakubets' ties to the FSB, and TrickBot operators' apparent targeting of US election infrastructure in 2020. Experts describe a spectrum of state-criminal cooperation ranging from ad hoc tasking to deep sponsorship, noting that Russia grants criminal groups a 'long leash' as long as they avoid targeting domestic organizations, providing plausible deniability while advancing Kremlin interests abroad.
The discussion also covers Belarus-linked group UNC1151, which Ukraine attributes to Belarusian intelligence and which allegedly defaced government websites and deployed wiper malware in January 2022, later linked to spear-phishing campaigns targeting European nations aiding Ukrainian refugees. Experts differ on the degree of Belarus-Russia cyber cooperation, with some seeing alignment given Lukashenko's dependence on Russian support, and others viewing Belarusian actors as more independent.
Panelists reflect on Russian state-sponsored groups including Sandworm (GRU), APT28 (GRU), and Turla (FSB), noting Sandworm's history with BlackEnergy and the 2015 Ukrainian power grid attack, as well as the 2017 NotPetya attack attributed to Russian military intelligence. Discussion of the current war notes that expected large-scale destructive cyberattacks did not materialize alongside the invasion, with observed activity limited to DDoS attacks, defacements, and wiper malware—assessed as relatively rudimentary compared to expectations, though the NCSC's disclosure of Sandworm's Cyclops Blink tool suggests more capable tooling exists in reserve.
Mentioned in this report
Detection guidance
Large-Scale Phishing Campaign with Spear-Phishing Indicators
A behavioural hunt for the technique in general.
Detects email client or attachment handling processes consistent with spear-phishing distribution campaigns targeting specific geographic regions or user populations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Large-Scale Phishing Campaign with Spear-Phishing Indicators
description: Detects processes associated with email clients or Office applications
spawning child processes to open attachments, combined with suspicious network indicators
or archive extraction - consistent with spear-phishing campaigns. Targets parent/child
relations and archive handling characteristic of phishing campaigns distributing
malware payloads.
tags:
- attack.initial-access
- attack.t1566
logsource:
category: process_creation
product: windows
detection:
selection_email_attachment:
ParentImage|endswith:
- \outlook.exe
- \thunderbird.exe
Image|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \AcroRd32.exe
selection_archive_extraction:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
Image|endswith:
- \WinRAR.exe
- \7zFM.exe
- \explorer.exe
CommandLine|contains:
- .zip
- .rar
- .7z
selection_suspicious_office_args:
Image|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
CommandLine|contains: /dde
filter_legit_extract:
CommandLine|contains:
- Program Files
- Updates
condition: (selection_email_attachment or selection_archive_extraction or selection_suspicious_office_args)
and not filter_legit_extract
falsepositives:
- Users manually extracting email attachments via archive managers
- Legitimate software update mechanisms using DDE
level: medium
id: e6f255a0-f915-5db4-9375-2757a6aae950
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-russias-cyber-statecraft
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs