DNC email leak: Russian hackers Cozy Bear and Fancy Bear behind breach

Guccifer 2.0, the hacker behind the recent Democratic party email leak, is not a single operator but Russian cybercriminals designated Fancy Bear and Cozy Bear by investigators who have invaded the White House and the Bundestag between them, according to leading cybersecurity firms.

Security firm ThreatConnect issued a comprehensive report on Tuesday using their own data and data from previous reports by rivals CrowdStrike, Mandiant and Fidelis.

Crowdstrike associates Fancy Bear with other Russian intrusions, notably one into the German Bundestag in May and another into French television network TV5 Monde. Cozy Bear has dug into the state department the joint chiefs, and the White House, said CrowdStrike, which analyzed those hacks.

The hack of the Democratic National Committee (DNC) is now being investigated by the FBI. DNC emails leaked by Guccifer 2.0 caused immense embarrassment ahead of the Democratic national convention. The leaks led to the resignation of Debbie Wasserman Schultz, DNC chair, after they revealed party staffers had favored Democratic presidential candidate Hillary Clinton over rival Bernie Sanders.

“We’ve had lots of experience with both of these actors attempting to target our customers in the past and know them well,” wrote CrowdStrike’s Dmitri Alperovitch. “In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis.”

The new ThreatConnect report suggests that the person who has been giving interviews under the name Guccifer 2.0 to the press isn’t a hacker at all.

‘I find it interesting’

In June, Guccifer contacted Vocativ writer Kevin Collier through Twitter to offer a story about the DNC leaks, insisting on encryption; Collier said the story he received by email was so offbeat he asked Guccifer what good it could possibly be. “I find it interesting” was the only reply.

Collier also said there was something else odd about the email: it had come from a French AOL service so insecure that it included the sender’s IP address in the email.

“It’s baffling,” Collier told the Guardian. “He’s either an amateur, made a huge mistake, or this is part of an incredibly intricate disinformation campaign. Since the going theory of the DNC hack is that it was perpetrated by Russian government groups that then passed this information to propagandists or professional trolls to spread, my best guess is it was just a rookie mistake.”

The sender had used a proxy, but the proxy masking Guccifer’s location was Russian.

Guccifer 2.0 had always claimed to be Romanian like the original Guccifer, imprisoned hacker Marcel Lazăr Lehel, but the 2.0 version had regularly communicated with journalists in Russian. When Motherboard reporter Lorenzo Franceschi-Bicchierai asked Guccifer 2.0 to speak Romanian, the few sentences that came back were filled with mistakes.

Then there was the way Guccifer claimed to have attacked the DNC with a “zero-day” hack into a software called Votebuilder used by the DNC. A zero-day hack finds a vulnerability in the software that was previously unknown to the target.

A backdoor into Votebuilder would only be valuable to someone attacking the DNC; most black-market activity focuses on exploitation of widely used software that can be used on multiple targets to make money until it is discovered and closed down.

Toni Gidwani, director of research operations for ThreatConnect, said: “There are much easier ways to get in.”

Another security company, Secureworks, found what may be the culprit: a fake Google login page targeting the Clinton campaign.

Gidwani said the various mistakes and inconsistencies indicate to ThreatConnect that a lot of the decisions around the hack appear to have been arrived at by committee with varying degrees of knowledge about hacking.

“It would suggest to us that the operators of the Guccifer 2.0 persona were not the actors who breached the DNC,” she said. “You’re looking at the operations guys who don’t have the same technical credibility as these very sophisticated actors who exploited these networks. You’ve got a lot of cooks in this kitchen here, not just one actor.”