Pattern recognition —

Fancy Bear ramping up infowar against Germany—and rest of West

Russian hackers part of broader campaign against West, German intel chief warns.

Now we have names for Fancy Bear.
Enlarge / Now we have names for Fancy Bear.

US intelligence agencies have been forthright in their insistence that the Russian government was behind not only the hacking of the Democratic National Committee (DNC) and other political organizations in the US, but a concerted effort to undermine confidence in the results of the US presidential election, including attacks on state election officials' systems. But the US is not the only country that the Russian government has apparently targeted for these sorts of operations—and the methods used in the DNC hack are being applied increasingly in attempts to influence German politics, Germany's chief of domestic intelligence warned yesterday.

In a press release issued on December 8, Germany's Bundesamt für Verfassungsshutz (BfV), the country's domestic intelligence agency, warned of an ever-mounting wave of disinformation and hacking campaigns by Russia focused on increasing the strength of "extremist groups and parties" in Germany and destabilizing the German government. In addition to propaganda and disinformation campaigns launched through social media, the BfV noted an increased number of "spear phishing attacks against German political parties and parliamentary groups" using the same sort of malware used against the Democratic National Committee in the US.

The statement from the BfV came on the same day that Alex Younger, the chief of the United Kingdom's Secret Intelligence Service (MI6) made more veiled references to disinformation and hacking campaigns. In remarks Younger delivered at Vauxhall Cross, MI6 headquarters, he warned of the mounting risks posed by "hybrid warfare."

"The connectivity that is at the heart of globalization can be exploited by States with hostile intent to further their aims deniably," Younger said. "They do this through means as varied as cyber-attacks, propaganda or subversion of democratic process… The risks at stake are profound and represent a fundamental threat to our sovereignty; they should be a concern to all those who share democratic values."

The statement from the BfV follows one by German Chancellor Angela Merkel last week voicing concerns that Russia would attempt to interfere in the 2017 German elections. In the release, BfV Chief Hans-Georg Maassen warned that these "propaganda and disinformation attacks, cyber espionage, and cyber sabotage are part of hybrid threats against Western democracies." He added that the way people use social media to obtain news was aiding disinformation campaigns.

"We are concerned that echo chambers are emerging that make the formation of domestic political opinions highly vulnerable to automated opinion-shaping," Maassen warned.

The campaign includes the "enormous use of financial resources" to fund disinformation campaigns, the BfV reported. The disinformation campaigns have been accompanied by an increase in targeted malware attacks on German politicians. The BfV attributed these attacks to the threat group known as APT 28, also known as Fancy Bear—a group that US intelligence and information security researchers have tied to Russian intelligence. In 2015, APT 28 "successfully exfiltrated data from the German Bundestag," Germany's parliament, the BfV release noted. Many of these attacks have been launched as "false flag" operations—with the attackers posing as "hacktivists," much as Guccifer 2.0 and the DC Leaks campaigns tied to APT 28 did.

The combined use of disinformation in social media and in state-funded media, social media "trolling," and concerted hacking efforts against political institutions is part of a long pattern of behavior by Russia, shaped by Russia's doctrine of information warfare and deterrence. Russia is generally believed to have been behind cyber-attacks and propaganda operations against Estonia and Ukraine, among other former Soviet states, and has reportedly been behind similar operations in Poland.

Given the effect that the DNC hack and other information warfare had in the US—not necessarily influencing the final results, but creating the impression that Russia could directly interfere in US politics—Estonian Foreign Minister Sven Mikser told Reuters at a meeting of the Organization for Security and Cooperation in Europe on December 8, "It's a pretty safe bet that they will try to do it again, and they will try to surprise us. That’s something that we should be very careful to look at and try to protect ourselves from."

Channel Ars Technica