APT28 🤝 war crimes

Importantly, this threat is not unique to Signal, and is already seeing wider use outside of Ukraine. See, for example, UNC5792’s effort to compromise the WhatsApp account of Christo Grozev using a fake invite to the World Economic Forum in Davos.

A reference to 29155 (not the VIO as some might assume) per WaPo:

www.washingtonpost.com/world/2024/1...

Peak dystopia: when the hannukah gelt are now bitcoin

The implications of Musk's economic entanglements in China for Starlink's future reliability in emerging crises and conflicts is a pressing issue.

Good to see it featured here by the @washingtonpost.com

Please don't be terrible

A phenomenal graphic showing the scale and diversity of Russia's salvo targeting Ukraine's energy grid yesterday

The remarkable part is the first evidence required for more measured assessment was less than 24 hours away

To no surprise, Russia clearly sees possibility in Israel-Palestine conflict. Expect opportunistic exploitation of events to divert attention (and resources if possible) away from Ukraine.

Russian grievances with the International Olympic Committee have been a historical driver of full spectrum cyber operations.

Decision to suspend Russia is likely to animate similar efforts. Don't discount Moscow's ability to service emerging requirements in parallel to Ukrainian priorities.

It's worth noting this is highly likely the same underlying logic to Russia's opening wiper salvo in Ukraine - to disorganize Ukraine's response.

Crucial to consider how Beijing's thinking has since been shaped by Russia's cyber offensive

But not all things stay the same. We've seen significant changes in Russia’s disruptive tool choices. In Ukraine, the GRU has heavily favored “pure” wipers that are pre-packaged and primed for immediate use. Another likely adaptation to a wartime operating environment.

The GRU has also continued to integrate self-proclaimed hacktivist personas into its cyber operations. Many of the activities carried out by these false fronts – crowdsourcing DDoS, leaking documents, claiming responsibility for ops – echo all the way back to 2014.

It’s also important to understand this playbook in Russia’s own terms. The components of the playbook integrate Russia’s full spectrum of information confrontation (Информационное противоборство) capabilities conceptually defined as KRIKS (КРИКС), ITV (ИТВ), and IPV (ИПВ).

The takeaway: The GRU has followed the same five phase disruptive playbook throughout the war. Alternatives have existed, but the GRU has opted for the same tradecraft on repeat. We assess that these choices are calculated adaptations to a wartime operating environment.

Big Turla takedown vibes

Greetings from the NAFO Brussels chapter.