The Ugly Face of Hybrid Warfare in Cyberspace: Fancy Bear (APT28)

The wife of an American colonel who had served for years in Afghanistan and Iraq is shocked by a threatening message sent to her phone by the “CyberCaliphate”.

“We are closer to you than you think. We know you, your children and your husband.”

She immediately calls her husband and her friends and learns that the message was sent at the same time to the wives of four other officers. Like the other officers’ wives, the colonel’s wife who received the threat was a woman who was prominent on social media and in charitable projects.

Whoever sent threats to officers’ wives who ran websites, wrote books, were active on social media and organised support networks for service members and their families was certain the incident would soon make the news. At the same time, several Twitter accounts hijacked under the same name posted messages to the American media about ISIS’s strength inside the country and the American soldiers’ hostility towards Islam.

The perpetrator, APT28 (Fancy Bear), surfaced in France soon afterwards. The French television channel TV5 Monde was hacked and only recovered hours later. The logo and religious messages posted on the channel’s website after the hack were the same as those the officers’ wives in America had encountered. According to French and American experts, APT28 was trying to escalate tensions and keep radicalism in the headlines.

An interesting detail that emerged in the investigations called to mind the Russian troll farm, where state-backed hackers were organised. According to experts, the fact that the attacks matched office hours in Russia showed that they were dealing with state employees rather than cybercriminals who keep security experts awake at midnight.

APT28 joined Russia’s hybrid war by attacking the wives of American officers. Its aim was to create the perception that ISIS was very strong and that hostility to Islam was growing in the West.

What is an APT?

APT (Advanced Persistent Threat) is a term for attacks that aim to infiltrate computer systems and steal information. APTs are usually state-backed, sophisticated, long-running and targeted.

APT28 (Fancy Bear) is a hacker group devoted to harassing America and Europe. It steps in whenever Russia’s interests are harmed and, in its spare time, deals with Putin’s domestic opponents.

In recent years the World Anti-Doping Agency (WADA), which exposed doping by Russian athletes and recommended that they be banned from the Olympics, soon got its share of cyberattacks. The hackers used two different tactics in the WADA attack: on the one hand they sent fake e-mails to the agency’s staff, and on the other they gained unauthorised access to an account created for the Rio 2016 Olympics. In this way they obtained confidential medical data of a number of Olympic athletes. According to the leaked documents, the legitimate therapeutic use exemptions (TUEs) of many successful athletes, including Americans, were distorted to make it look as if they had used doping.

The Democrats and Hillary Clinton, who openly criticised Putin and said she would never get along with him, were targeted repeatedly through the committees she led and through a fake e-mail sent to her adviser John Podesta. Tens of thousands of e-mails were stolen in these attacks and published by WikiLeaks.

APT28, believed to be linked to Russian intelligence, has been given different names by cybersecurity firms depending on the type of attack. For instance, it was named “Pawn Storm” because attacking a target with two or more tactics resembles chess. The most widely used name, “Fancy Bear”, was coined by Dmitri Alperovitch, one of the founders of the well-known cybersecurity company CrowdStrike.

APT28’s Tactics

APT28, which has carried out many complex attacks successfully and has been making life hard for cybersecurity experts for about 20 years, has stood out above all for two types of attack:

1. Fake e-mail attacks tailored to a specific organisation or person: “spear-phishing”

· The target is sent an update e-mail asking for their password, or a message saying there is a security risk in the system they are trying to log in to. Once the victim enters their password and the other requested information, everything is stolen.

The e-mail that reached Hillary Clinton’s adviser John Podesta said he needed to update his Google account. Instead of entering his e-mail address and password, the experienced politician asked the IT security team whether the e-mail was fake, but a misunderstanding with the security analyst led Podesta to trust the e-mail and click the link.

· A fake e-mail is sent to the targeted person or organisation. Attached to it is an intriguing document or one of personal interest to the target. When the document is opened, malware is installed on the computer.

For example, one document APT28 sent to its victims gave the impression of being a NATO document.

2. Collecting sensitive information through fake or compromised websites: “website spoofing” and “watering hole”

· A fake copy of a much-visited website is prepared and a link to it is sent to the target. Thinking they are visiting a site they always use, the victim clicks the link, and malware is installed on their computer or their data is stolen. In a “watering hole” attack, by contrast, a real site regularly visited by the target group is compromised and malicious code is planted on it. Examples:

o Real domain: standartnews.com | Fake domain: standartnevvs.com

o Real domain: nshq.nato.int (NATO Special Operations HQ) | Fake domain: nato.nshq.in

o Real domain: osce.org (Organization for Security and Co-operation in Europe) | Fake domain: login-osce.org

APT28, which years ago targeted the German parliament and Merkel’s Christian Democrats, reappeared in Germany in 2023. It attacked numerous e-mail accounts belonging to the then governing Social Democrats.

According to military strategist Frank G. Hoffman, hybrid warfare consists of unconventional attacks launched simultaneously with conventional military tactics. All states, Russia above all, see modern war as omni-directional; that is, they argue that in addition to land, air and sea operations, every domain and every concept must be regarded as part of war.

APT28, the cyber extension of Russia’s hybrid war, was under close watch by intelligence services. Thanks to the cooperation of several secret services, it was exposed in the Netherlands. Four men who parked a small car in front of the Organisation for the Prohibition of Chemical Weapons (OPCW) in order to break into its network were caught red-handed by Dutch intelligence and expelled from the country. A search turned up plenty of evidence, including a taxi receipt. Kept so that the expense could be reclaimed from the accounts department as official business, the receipt was for a taxi from GRU headquarters to the airport.

This amateurish mistake was enough to dispel APT28’s mystique. When the attempts against the Konrad Adenauer Foundation in Germany and the e-mails leaked from Macron’s 2017 election campaign also failed to have the intended effect, APT28’s aura was shattered.

Warming up to hybrid war through cyberattacks, APT28 quickly became a threat that attracted attention, but attacking high-profile targets and going into the field in person led it to make mistakes. Arrest warrants were issued for many APT28 members, including the hacker known as “the man in Merkel’s computer”, and leaving Russia became all but impossible for them.

Putin commented on what the exposed APT28 members had done with “Why should I care?” and, as expected, denied any link to Russia.