A cybersecurity company has uncovered strong evidence of the tie between the group that hacked the Democratic National Committee and Russia's military intelligence arm -- the primary agency behind the Kremlin's interference in the 2016 election.
The company CrowdStrike linked malware used in the Democratic National Committee intrusion to malware used to hack and track an Android phone app used by the Ukrainian army in its battle against pro-Russia separatists in eastern Ukraine from late 2014 into 2016.
While CrowdStrike, which was hired by the committee to investigate the intrusions and whose findings are described in a new report, had always suspected that one of the two hacker groups that struck the DNC was the GRU, Russia's military intelligence agency, it had only medium confidence.
Now, said CrowdStrike co-founder Dmitri Alperovitch, "we have high confidence" it was a unit of the GRU. CrowdStrike had dubbed that unit "Fancy Bear."
The FBI, which has been investigating Russia's hacks of political, government, academic and other organizations for several years, privately has concluded the same. But the bureau has not publicly drawn the link to the GRU.
CrowdStrike's fingering of the GRU helps to deepen the public's understanding of how different arms of the Russian government are carrying out cyber operations in the United States. The director of national intelligence and the Homeland Security secretary in October publicly accused the Russian government for interfering in the U.S. election, including through hacks of political organizations and targeting of state election systems.
After the election, the CIA and other intelligence agencies concluded that one of Russia's aims was to help Donald Trump win the election through a campaign of "active measures" that included dumping stolen emails onto public websites.
The GRU, evidently, was key to this operation.
"The GRU is used for both tactical intelligence collection in the battlefield in support of Russian military operations and also strategic active measures or psychological warfare overseas," said Alperovitch, who is an expert on Russia and a senior fellow at the Atlantic Council. "The fact that they would be tracking and helping the Russian military kill Ukrainian army personnel in eastern Ukraine and also intervening in the U.S. election is quite chilling."
CrowdStrike found that a variant of the Fancy Bear malware that was used to penetrate the Democratic National Committee's network in April 2016 was also used to hack an Android app developed by the Ukrainian army to help artillery troops more efficiently train their antiquated howitzers on targets.
The Ukrainian army's D-30 towed howitzers, which date to the Soviet era, typically take a number of minutes to position based on hand-drawn targeting data. With the Android app, positioning takes 15 seconds, CrowdStrike found.
The Fancy Bear crew evidently hacked the app, allowing the GRU to use the phone's GPS coordinates to track the Ukrainian troops' position. In that way, the Russian military could then target the Ukrainian army with artillery and other weaponry.
Ukrainian brigades operating in eastern Ukraine were on the front lines of the conflict with Russia-backed separatist forces during the early stages of the conflict in late 2014, CrowdStrike noted. By late 2014, Russian forces in the region numbered about 10,000. The Android app was useful in helping the Russian troops pinpoint Ukrainian artillery positions.
According to the International Institute for Strategic Studies, Ukrainian artillery forces lost more than 50 percent of their weapons in the two years of conflict and more than 80 percent of their D-30 howitzers, the highest percentage of loss of any artillery piece in their arsenal, the report stated.
The app was not available in the Android app store and was distributed only through the social media page of its developer, who is a Ukrainian artillery officer, Yaroslav Sherstuk, according to CrowdStrike. It could be activated only after the developer was contacted and a code was sent to the individual downloading the application.
CrowdStrike's findings were met with skepticism in Ukraine.
Sherstuk said he wasn't speaking to reporters when reached by telephone. In a series of Facebook posts, he dismissed the CrowdStrike story as "rotten information." Nevertheless, he urged soldiers to download only updated versions of the app directly from him.
"Delete earlier versions of the program," he wrote Thursday.
Victor Romanchuk, a Ukrainian programmer who said he was familiar with the app, suggested it wouldn't make a very good spy tool. The program is often used on specially ordered tablet computers with no Internet connection, said Romanchuk, making them of limited use to an enemy seeking real-time information on troop movements in the field.
Russia's Ministry of Defense did not immediately return a message seeking comment, but Russia's leadership has repeatedly rejected allegations that the Russian military is involved in Ukraine.
The other group that hacked the Democratic National Committee also works for Russian intelligence, CrowdStrike reported earlier this year. But the firm is not sure if it is the more internally focused FSB, or the foreign intelligence arm, the SVR. Both grew out of the KGB.
That group, which CrowdStrike has called Cozy Bear, apparently has not been deployed in the influence operation, Alperovitch said. Rather, it is focused on traditional espionage. It is the group that is believed to have hacked unclassified networks of the State Department, White House and the Joint Chiefs of Staff.
Information for this article was contributed by Ellen Nakashima of The Washington Post and by Tami Abdollah, Raphael Satter and Sveta Kozlenko of The Associated Press.
A Section on 12/23/2016