Skip to content
Naked Security Naked Security

Ukrainian hackers ‘snatch huge email cache from Kremlin’

The emails reportedly show Russia's organizing Ukrainian separatists. The hack, if legit, shows Russian leaders are as vulnerable as others.

Two Ukrainians calling themselves hacktivists have given the BBC access to what they say are thousands of emails they claim to have pried out of the Kremlin.

They claim to have gotten into inboxes belonging to Vladislav Surkov, a politician of Chechen descent who’s one of the architects of the country’s current political systems.

After poring over the messages, the BBC concludes that the communications undercut Russia’s assertions that the Ukrainian separatist movement amounts to a civil war.

Rather, the BBC says that the emails portray Russia as a puppet-master, controlling the authorities leading that separatist movement, which has resulted in a two-year-old battle that’s still incurring casualties.

According to the BBC, these are some of the items allegedly contained in the document dumps (there were two: one last week and one the week before):

  • Budgets for the breakaway pro-Russian “republics” in eastern Ukraine
  • A plan for Moscow to relieve fuel shortages in the separatist-held regions
  • A list of separatist politicians, which was apparently sent to Surkov’s office. “The implication is that Russia has a say in who governs separatist-held eastern Ukraine,” according to the BBC
  • An attachment, allegedly sent by the separatist leader Denis Pushilin in January, that shows a map of Ukraine carved up into three regions. The eastern part is marked as “Novorossiya” (New Russia). The central region is labelled “Malorossiya” (Lesser Russia)
  • Evidence that Russia was interested in fostering discontent and organizing and paying for protests in Kharkiv, Ukraine’s second biggest city

It’s not known how the hackers cracked the inboxes, which include prm_surkova@gov.ru and pochta_mg@mail.ru. They told the BBC that the second inbox belongs to one of Surkov’s staff.

None of the revelations in this cache of mundane, day-to-day business is earth-shattering news. There’s already ample evidence that Russia is supplying weapons and is involved in the war.

But beyond the content of the emails, the hack itself is noteworthy.

As it is, the US government has been on the receiving end of exactly this type of attack and has repeatedly pointed the finger at Russia as the power behind multiple incidents.

One such was the email leak that beset the Democratic National Committee (DNC), which happened after two of its servers were compromised.

The Ukrainian hackers may not be up for explaining how they allegedly pulled off the same thing on the Kremlin, but for what it’s worth, we’ve seen a fascinating dissection of the attack on the DNC.

That attack has been traced to Fancy Bear, a Russian hacking group, which used Bitly shortened URLs in spearphishing attacks that managed to weasel Gmail login accounts out of targeted DNC officials.

The Russian government is denying the veracity of all of the emails and all of the BBC’s allegations. In fact, it’s denying that Surkov even uses email.

But the BBC talked to analysts who say that the sheer volume of mundane materials in the emails back up their authenticity. One example: a 2014 email inviting Surkov to a party at which singer Robbie Williams performed.

There are too many people mentioned, with too many details, to be whipped up from scratch, they say.

Besides, the coding and server details that the messages were routed through would be “incredibly difficult to fake,” the BBC noted.

2 Comments

The Ukrainian government should stop being a puppet of the west and start thinking of implementing the minsk agreement in order for the war to stop. The U.S should also use its influence on Ukraine to pressure it to implement the minsk agreement and stop using Ukraine as a weapon against Russia and also to convince the European union to keep up its sanctions against Russia

It reminds me of an interesting information security saying: “Our security sucks, but so does theirs.” With today’s state of information technology, it’s easier to attack than defend.

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?