The GRU is described as Russia's foreign intelligence agency.
Explicit Confidence 99% · Jack Rhysider EP 21 Details
“The GRU is Russia’s foreign intelligence agency”
Country
country:russia
Also: Russian, Russian Federation, Russian government, Russian intelligence, Russians, Soviet Union
Country identified in the episode as Alex Vinnik's nationality.
Country identified in the episode as Alex Vinnik's nationality.
“is a Russian national”
Country associated in the episode with the GRU and Stan's former intelligence service.
“The GRU is Russia’s foreign intelligence agency”
Country associated with Vladimir Levin, the Tambov gang, and the Russian police in the episode.
“Vladimir Levin in St. Petersburg, Russia”
Country mentioned in reports about the possible location of some IRS identity thieves; the episode also notes activity beyond Russia.
“News reports indicate that the recent IRS identity thieves may have been in Russia.”
“It’s beyond Russia.”
Country associated in the episode with Roman’s residence, Russian authorities, and servers receiving stolen-card data.
“he was living in Vladivostok, Russia”
“transmit that data to a server in Russia”
Country associated in the episode with affected banks, investigators, and suspected attackers.
“He was an IT person from a large bank in Russia.”
Country associated in the episode with the Moonlight Maze intrusion into a US Air Force base.
“which was Russia hacking into a US Air Force base”
Country named among possible state actors considered during attribution analysis.
“Russia, China, the US, Israel.”
Country associated in the episode with the creators of Angler and arrests connected to Lurk.
“We think it was probably Russian-made.”
“eighty-six raids in Russia arrested more than fifty individuals”
Country repeatedly discussed as a possible actor or beneficiary connected to the Shadow Brokers activity and election hacking.
“most signs do point to Russia being behind the Shadow Brokers, but we don’t know for certain.”
The country identified by the episode and later government statements as responsible for the military operation behind NotPetya.
“the White House put out a statement, a very, very short statement that just said yes, NotPetya was the worst cyber-attack in history and it was deployed by the Russian military against Ukraine”
“the entire campaign of cyber-attacks carried out against Ukraine”
Country described as conducting an aggressive campaign to influence the 2016 US election.
“whether or not Russia has been running psychological operations on people in the US to influence us in the way we vote”
“this was the most aggressive and most direct and most assertive campaign that the Russians ever mounted”
Country discussed in connection with suspected attribution of the Triton-related activity.
“a number of folks came out and have attributed this to the Russian government”
Country discussed as the destination for information supplied by Aldrich Ames and as a recipient of Iranian counterintelligence information.
“Aldrich gave a lot of information to the Russians”
Country identified in the episode as responsible for the Olympic attack through GRU Unit 74455 and Sandworm.
“the Russian government was responsible for creating Olympic Destroyer”
“The defendants in this case were all members of the military unit 74455 of the Russia main intelligence directorate”
Country associated in the episode with the attacker’s IP addresses, residence, and service providers.
“his home which was in Moscow, Russia”
Country described as receiving or using capabilities associated with publicly released NSA exploitation code.
“it was picked up by North Korea and it was picked up by Russia”
Country presented as Slavik’s location and the location from which he continued operating beyond US custody.
“He was in Russia”
“He’s presumably still in Russia”
Country mentioned as the location of a proposed scientist job and as the former Soviet context for City 40.
“there’s a job opening for a scientist of his description there”
“secret cities that had existed in Russia”
Country identified as the birthplace of Alexander Garkusha.
“He was born in Russia but had lived in the US most of his life”
Country presented as the base or operating environment for many Russian-speaking ransomware actors, including REvil.
“there’s only so many countries that allow cyber-criminals to operate with almost impunity except a very small margin – marginal amount, and that’s Russia”
Country whose government is reported by Omar’s partners as being involved; the episode repeatedly qualifies this attribution.
“they told us that it was not just Dark Caracal; it was not just Conti, but also it was — Russia was also involved”
“Russia as in the Russian government”
Country associated in the episode with the external FTP host receiving financial data.
“That connection to an FTP server in Russia”
Country associated in the episode with the suspected attribution of the Shadow Brokers.
“it’s widely believed to be Russian intelligence”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | ASSOCIATED_WITH | GRU | Explicit | 21 |
| incoming | ATTRIBUTED_TO | IRS Get Transcript breach | Uncertain | 26 |
| incoming | ASSOCIATED_WITH | Kaspersky Lab | Explicit | 35 |
| incoming | TARGETS | Carbanak | Explicit | 35 |
| incoming | ASSOCIATED_WITH | Carbanak | Uncertain | 35 |
| incoming | ATTRIBUTED_TO | Moonlight Maze | Explicit | 37 |
| incoming | ASSOCIATED_WITH | Shadow Brokers | Uncertain | 53 |
| incoming | ASSOCIATED_WITH | Shadow Brokers | Uncertain | 158 |
| incoming | ATTRIBUTED_TO | NotPetya | Attributed | 54 |
| incoming | ATTRIBUTED_TO | 2016 US election influence campaign | Attributed | 65 |
| incoming | ASSOCIATED_WITH | Triton | Uncertain | 68 |
| incoming | ASSOCIATED_WITH | Aldrich Ames | Explicit | 75 |
| incoming | ASSOCIATED_WITH | Maria Ames | Uncertain | 75 |
| incoming | INVOLVES | CIA covert communications compromise | Attributed | 75 |
| incoming | ATTRIBUTED_TO | Olympic Destroyer | Attributed | 77 |
| incoming | ATTRIBUTED_TO | Conti | Attributed | 135 |
| incoming | ATTRIBUTED_TO | The D.R. Incident | Uncertain | 135 |
| incoming | ASSOCIATED_WITH | Defcon financial-data exfiltration | Uncertain | 157 |
The GRU is described as Russia's foreign intelligence agency.
Explicit Confidence 99% · Jack Rhysider EP 21 Details
“The GRU is Russia’s foreign intelligence agency”
IRS Get Transcript breach ATTRIBUTED_TO Russia
News reports indicated that the identity thieves may have been in Russia; this attribution was explicitly presented as uncertain and incomplete.
Uncertain Confidence 91% · Jack Rhysider EP 26 Details
“News reports indicate that the recent IRS identity thieves may have been in Russia.”
Kaspersky Lab ASSOCIATED_WITH Russia
Jack says Kaspersky Lab is based in Moscow, Russia.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Kaspersky Lab is based in Moscow, Russia”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
Carbanak ASSOCIATED_WITH Russia
The episode presents the operators as Russian hackers or people fluent in Russian, so the Russian association is not certain.
Uncertain Confidence 84% · Jack Rhysider EP 35 Details
“Russian hackers or someone fluent in Russian found their way into a Russian bank’s network”
Moonlight Maze ATTRIBUTED_TO Russia
Jack describes Moonlight Maze as Russia hacking into a US Air Force base.
Explicit Confidence 97% · Jack Rhysider EP 37 Details
“an attack called Moonlight Maze which was Russia hacking into a US Air Force base”
Shadow Brokers ASSOCIATED_WITH Russia
Jack says most signs point to Russia being behind the Shadow Brokers, but explicitly notes that this is not known for certain.
Uncertain Confidence 86% · Jack Rhysider EP 53 Details
“most signs do point to Russia being behind the Shadow Brokers, but we don’t know for certain”
The White House and the other Five Eyes intelligence agencies publicly attributed NotPetya to Russia, specifically saying it was deployed by the Russian military against Ukraine.
Attributed Confidence 99% · Andy Greenberg EP 54 Details
“the White House put out a statement, a very, very short statement that just said yes, NotPetya was the worst cyber-attack in history and it was deployed by the Russian military against Ukraine”
“The US, Canada, New Zealand, Australia, and the UK all simultaneously called out Russia as the perpetrator of NotPetya.”
2016 US election influence campaign ATTRIBUTED_TO Russia
James Clapper says the Russians mounted the most aggressive and direct campaign in the history of US elections to interfere with and influence the outcome of the 2016 election.
Attributed Confidence 97% · James Clapper EP 65 Details
“this was the most aggressive and most direct and most assertive campaign that the Russians ever mounted”
The episode reports that some analysts attributed the activity to the Russian government, while Robert Lee emphasizes that high-confidence attribution is difficult and does not endorse a definitive Russian attribution.
Uncertain Confidence 76% · Robert Lee EP 68 Details
“a number of folks came out and have attributed this to the Russian government.”
“I’m not saying... it’s Russia.”
Aldrich Ames ASSOCIATED_WITH Russia
Ames gave CIA information to Soviet and Russian intelligence, including the identities of CIA spies.
Explicit Confidence 99% · Jack Rhysider EP 75 Details
“Russia was capturing and killing the CIA agents that Aldrich Ames was giving them information on.”
Maria Ames ASSOCIATED_WITH Russia
Maria Ames was described in contemporaneous coverage as an alleged spy along with Aldrich Ames; the episode does not establish this as fact.
Uncertain Confidence 96% · Tv Host3 EP 75 Details
“Aldrich Ames and his wife Maria are still, of course, the alleged spies”
CIA covert communications compromise INVOLVES Russia
The episode reports that Iran passed information from the compromise to Russia as well as China.
Attributed Confidence 90% · Jenna McLaughlin EP 75 Details
“not only to Russia but also to Chinese officials.”
Olympic Destroyer ATTRIBUTED_TO Russia
The DOJ indictment attributed the Olympic sabotage to officers of Russia’s military intelligence unit 74455.
Attributed Confidence 99% · Doj EP 77 Details
“The defendants in this case were all members of the military unit 74455 of the Russia main intelligence directorate, known as the GRU.”
Jack says Conti has been widely attributed to Russia.
Attributed Confidence 91% · Jack Rhysider EP 135 Details
“Conti has been widely-attributed to be from Russia”
The D.R. Incident ATTRIBUTED_TO Russia
Omar says his partners told him Russia was involved in the Dominican Republic campaign, but he also presents the attribution as uncertain and based on what they learned during the investigation.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“they told us that it was not just Dark Caracal; it was not just Conti, but also it was — Russia was also involved”
Defcon financial-data exfiltration ASSOCIATED_WITH Russia
The incident was associated with Russia because the FTP server connection and its IP address were identified as being in Russia; the episode does not establish who operated the server.
Uncertain Confidence 93% · Grifter EP 157 Details
“That connection to an FTP server in Russia — the IP address was also geolocated to Russia”
Shadow Brokers ASSOCIATED_WITH Russia
The Shadow Brokers are said not to have been attributed at the time, but were widely believed to be Russian intelligence.
Uncertain Confidence 95% · Malwaretech EP 158 Details
“the Shadow Brokers isn’t — they haven’t been attributed yet, but it’s widely believed to be Russian intelligence”