Leonid Bershidsky — How Russian Hackers Became a Kremlin Headache

Leonid Bershidsky adds some more (possible) pieces to the puzzle.

Bloomberg View
How Russian Hackers Became a Kremlin Headache
Leonid Bershidsky

Brian Krebs — A Shakeup in Russia’s Top Cybercrime Unit

Update in the cyber situation in Russia. There has been some more information coming out but the translations from Russian have been rough, so I haven't put it up. This is an American cyber security guy familiar with the situation. It's the most comprehensive report available so far.

Warning. It's Byzantine and still a labyrinth. Not clear yet what is going on.

Krebs on Security
A Shakeup in Russia’s Top Cybercrime Unit

Brian Krebs, Krebs Security

Yekaterina Sinelschikova — Russian server head: Hacks on U.S. weren’t even worthy of Bond movie

The hackers who broke into U.S. Democratic Party files wrote in broken English and were extremely amateurish, the owner of the Russian company King Servers, from whose servers the attacks originated, told RBTH, whilst denying any involvement in the scandal.

The investigation of the controversial hacking into state voting systems in two U.S. states have led American experts to Biysk, a small industrial town in the south of Siberia (2,300 miles east of Moscow). This is where 26-year-old Vladimir Fomenko, whose company King Servers rents out server space in the United States, the Netherlands and Russia, lives and works.

In June this year, according to the FBI, Russian hackers staged "significant" cyber-attacks from servers rented from King Servers, penetrating the voter registration systems in Arizona and Illinois.

They had earlier broken into the computers of the Democratic National Committee, exposing emails and correspondence whose publication seriously compromised the position of Democratic presidential candidate Hillary Clinton, as well as Democratic research on Republican candidate Donald Trump.

After the FBI revealed that Russians were highly likely to be behind the attacks, the U.S. media was quick to report the “Russian trace.” And while the Kremlin denied any involvement in the incident, the company from Biysk wondered why no one had contacted it, since everything written in the Western press was connected with it.

The American cybersecurity company ThreatConnect even described Fomenko as the manager of an "information nexus" used by hackers who targeted Germany, Turkey and Ukraine, among other countries, according to an article by The New York Times.

"I really did not cooperate and am not cooperating with Russian or any other special services," Fomenko said in an interview with RBTH. "We were not contacted even by the FBI to obtain data that would allow the criminals to be caught."…

"If we consider the situation from the other side, it is unclear why the FBI and related experts are talking only about our company," said Fomenko.

"After all, the U.S. intelligence report says that the hacking was staged from eight IP addresses, six of them belonging to our company (the criminals used our equipment), and two other companies being not connected with us in any way. One of them is located in the Netherlands, I don’t know about the other. But it's all just about us. What is this? Prejudice?"…

As for the "Russian trace," it turns out to be have been all too obvious, said Fomenko. The hackers left several messages for King Servers' support service written in broken English, though he claimed this “would be very strange for the Russian special services, when applying for assistance to a Russian company.”

Additionally, the e-mail addresses used for registration contain the following name, literally – "Robin Good" (with G, rather than H – typical of Russian transliteration). 

"I don’t think that the security services work so unprofessionally," said Fomenko. "Of course, I can only judge from movies, but even the James Bond movies show Russians as more inventive."

Russia Beyond the Headlines
Russian server head: Hacks on U.S. weren’t even worthy of Bond movie
Yekaterina Sinelschikova

RT — Russian server co. head on DNC hack: ‘No idea’ why FBI still has not contacted us

Blaming Russia because servers are from here is “absurd,” Vladimir Fomenko, owner of the Russian server company implicated in the DNC hack, told RT adding that they are ready to help any special service in investigating the attack.

Fomenko’s web hosting service, King Servers, was identified by American cybersecurity company ThreatConnect as the platform for the attack on emails of the Democratic National Committee. Six out of the eight IP addresses used by the hackers were hosted on King Servers, ThreatConnect claimed in September.

But the 26-year-old from Biysk, in western Siberia, is far from being scared or unwilling to cooperate. In fact, he recently told the New York Times that “If the FBI asks, we are ready to supply the IP addresses, the logs.” However, he says, “Nobody is asking… It’s like nobody wants to sort this out.”

Fomenko tells RT he was as surprised to learn from US media that his company was somehow implicated. He also believes that the only connection to Russia the Americans really have is the servers being from there.

“Thinking that the criminals must likewise also be from Russia is just absurd,” he says. “No one blames Mark Zuckerberg when criminals use Facebook for their own ends? … As soon as we learnt our servers were involved, we disconnected the perpetrators from our equipment. And conducted our own investigation. We have learnt certain things and are ready to share it with special services at their first call.”

Asked why the FBI still has not taken advantage of this opportunity, Fomenko said he had “no idea; you’d better ask them.”…

The King Servers boss says there was absolutely no way the company could have known it was being used for malicious activity, as it can only catch wrongdoing after the fact.

“We are ready to take on a pro-active role in investigating this crime. This is in our own best interest when the company’s reputation is at stake.”

RT

Russian server co. head on DNC hack: ‘No idea’ why FBI still has not contacted us