Russian cybercriminals serve as Kremlin proxies
Russia leverages cybercriminal groups like Conti and Evil Corp as proxy forces for state cyber operations, granting them immunity from prosecution in exchange for targeting foreign adversaries.
Multiple cybersecurity experts confirm that Russia's cyber statecraft relies heavily on cybercriminal organizations operating as state proxies. The Conti ransomware group's public pledge to support the Kremlin following Russia's invasion of Ukraine exemplified this relationship, though it represents only one facet of a complex ecosystem. US Treasury sanctions revealed that Evil Corp's leader Maksim Yakubets worked directly for the FSB, while groups like Buhtrap transitioned from criminal operations to exclusive cyber espionage after their tools were leaked in 2016. Russia adopts a model where criminal actors receive effective immunity from prosecution as long as they avoid targeting Russian organizations, creating what experts describe as a "license" to operate against foreign targets.
The relationship between Russian intelligence services and cybercriminals takes multiple forms, from direct tasking and recruitment to the adoption of criminal malware for state operations. Sandworm's use of the BlackEnergy malware in the 2015 Ukrainian power grid attacks demonstrates how Russia co-opts criminal tools. Experts note that Russian cyber power is more diffuse and entrepreneurial than Western models, with capabilities distributed across criminal gangs, private companies, and patriotic hackers who align their activities with perceived political leadership cues. This strategy provides the Kremlin with plausible deniability while imposing costs on Western organizations through ransomware and other attacks.
Despite expectations of massive cyber operations accompanying Russia's invasion of Ukraine, experts observed relatively limited cyber activity in the conflict's initial stages, with attacks focusing on rudimentary distributed denial-of-service attacks, website defacements, and basic wiper malware. Analysts caution against drawing premature conclusions, noting that the conflict remains in early stages and that Russia has not taken more sophisticated cyber capabilities off the table. The relationship between Belarusian and Russian cyber operations remains unclear, though Belarus-linked group UNC1151 has conducted operations aligned with Russian interests, including website defacements and wiper attacks against Ukrainian targets in January 2022.
Mentioned in this report
Detection guidance
Wiper Precursor - Windows Recovery Disabled via bcdedit
Detects bcdedit commands disabling Windows recovery/boot repair options, a common precursor step used by wiper malware (e.g. WhisperGate/HermeticWiper-style attacks) to prevent system recovery before destructive action. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Recovery Disabled via bcdedit
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\bcdedit.exe
CommandLine|contains:
- recoveryenabled no
- recoveryenabled off
- bootstatuspolicy ignoreallfailures
condition: selection
falsepositives:
- Legitimate system administration or imaging tasks that intentionally disable recovery
for deployment automation
- IT operations scripting during OS provisioning
level: high
tags:
- attack.t1485
- attack.impact
id: b6edb798-3c11-54e9-8b19-973a7f3d2438
status: experimental
author: Vorant
Volume Shadow Copy Deletion via vssadmin or wmic
Detects deletion of volume shadow copies using vssadmin or wmic, a common step in destructive wiper and ransomware operations to prevent file/system recovery, consistent with basic wiper malware used in Ukraine-related attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy Deletion via vssadmin or wmic
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \\vssadmin.exe
CommandLine|contains:
- delete shadows
- resize shadowstorage
selection_wmic:
Image|endswith: \\wmic.exe
CommandLine|contains: shadowcopy delete
condition: 1 of selection_*
falsepositives:
- Backup software or system administrators clearing old shadow copies to free disk
space
- Scripted maintenance tasks in enterprise environments
level: high
tags:
- attack.t1485
- attack.impact
id: 96d47e9f-e2eb-5a17-b2a9-90d24b6b001f
status: experimental
author: Vorant
Office Application Spawning Script Interpreter (Phishing Execution Chain)
Detects an Office application (Word, Excel, PowerPoint) spawning a command shell or scripting engine, a common execution pattern following a phishing lure with a malicious document as used by Russia-aligned criminal proxy groups. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\winword.exe
- \\excel.exe
- \\powerpnt.exe
- \\mspub.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\wscript.exe
- \\cscript.exe
- \\mshta.exe
condition: selection
falsepositives:
- Legitimate document macros used for business automation or mail merge processes
- Enterprise add-ins that spawn helper scripts from Office applications
level: medium
tags:
- attack.t1566
- attack.initial-access
- attack.execution
id: dba8752b-3cc5-5955-a3c4-3862d8ff13a8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-russias-cyber-statecraft
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free