War in Ukraine

Pawn Storm has a long history of targeting government agencies and private organizations to steal sensitive information. Our most recent findings show that they targeted the international investigation team of the MH 17 plane crash from different sides.

The Dutch Safety Board (known as Onderzoeksraad) became a target of the cyber-espionage group before and after the safety board published their detailed report on the MH 17 incident on October 13, 2015. We believe that a coordinated attack from several sides was launched to get unauthorized access to sensitive material of the investigation conducted by Dutch, Malaysian, Australian, Belgian, and Ukrainian authorities.

Figure 1. Official site of the Dutch Safety Board and the press release for the MH17 investigations ◊

We discovered that a fake server mimicking an SFTP server of the Dutch Safety Board was set up on September 28, 2015; later a fake VPN server of the same organization was set up on October 14, 2015. It is very likely these were used for credential phishing attacks against personnel of the Safety Board in order to get unauthorized access to both the SFTP and the VPN server.

This is the first time we have seen direct evidence that an APT group attempted to get unauthorized access to a VPN server. The VPN server of the Safety Board looks to use temporary tokens for authentication. However, these tokens can be phished in a straightforward way and tokens alone do not protect against one-time unauthorized access by third parties, once the target falls for the phishing attack.

The attacks weren’t limited to the Dutch Safety Board. On September 29 2015, a fake Outlook Web Access (OWA) server was set up to target an important partner of the Dutch Safety Board in the MH 17 investigation. We were able to warn the affected party in a very early stage, thus probably preventing the attack to succeed.

These discoveries show that it is very likely that Pawn Storm coordinated attacks against different organizations to get sensitive information on the MH 17 plane crash.

Pawn Storm and Syria

Pawn Storm has also intensified attacks against Syrian opposition groups and Arab countries that voiced objections against the recent interventions of Russia in Syria.

Last September, several Syrian opposition members in exile were the targets of advanced credentials attacks. Then in September and October 2015, several fake OWA servers were set up, targeting the military, ministries of defense, and foreign affairs of about all Arab countries that criticized the Russian intervention in Syria.

Figure 2. Fake OWA server of the armed forces of a targeted Arab country◊

The Pawn Storm Campaign

Pawn Storm is a long-running cyber-espionage campaign that has had numerous international targets, including the White House and the North Atlantic Treaty Organization. But our research also shows that while Pawn Storm’s targets have mostly been external political entities outside of Russia, a great deal of targets can actually be found within the country’s borders. Some of their “local” targets include peace activists, bloggers, and politicians.

For its cyber-espionage attacks, Pawn Storm is known for launching simple but effective phishing campaigns against organizations that have their webmail exposed to the Internet. The group is also known to use zero-day exploits.

Ukraine is increasing its reliance on European gas more than a year after it stopped purchasing energy from Russia over its annexation of Crimea. Ukraine started purchasing gas from French energy giant Engie last week in a costly show of defiance toward the Kremlin's outsized influence in the region.

Kiev is paying 20 percent more for gas now than it did when it purchased Russian energy. The fuel runs through the Hermanowice pipeline in southeast Poland every day, putting a strain on Ukraine's already difficult budget crisis. Ukraine counted on a loan from the European Bank for Reconstruction and Development (EBRD) to buy 1.8 bcm of gas from Western Europe companies in 2016.

Russia has tried to win Ukraine back by offering a discounted price of $186 per thousand cubic meters, nearly 20 percent less than the average rate Kiev is paying European companies for its fuel these days. The Ukraine's boycott is also hard to sustain in part because much of the gas Ukraine is purchasing from third party suppliers in Europe originates in Russia, attributing to the markup in prices. The higher fees are being passed down to Ukrainian consumers, who have seen the average utilities bill for a one room apartment grow to about $40 in the summer and $110 in the winter.

European Union officials meet with their counterparts in Russia and Ukraine in December to try to negotiate a resolution. Ukraine stopped buying from Russia's Gazprom in November 2015. Conflicts with Russia in the past have seen shortages during the freezing winter months in some EU nations.

In all, Russia delivers about a third of the gas flowing into the European Union. Ukraine is a crucial part of this structure because about 40 percent of Russia’s EU-bound gas gushes across its territory, representing more than 10 percent of Europe’s fuel supply. Ukraine has promised to protect the stable transit of gas to Europe.

The Organization for Security and Co-operation in Europe said last week conflict between Kiev and the pro-Russian insurgency in eastern Ukraine hasn't improved. The OSCE's new chairman, Austrian Foreign Minister Sebastian Kurz, said an international armed police presence is needed in the region to close Ukraine's porous eastern border with Russia, which is used by rebels to bring in weapons and supplies. The conflict has killed 10,000 people since 2014.

Russia has defended its annexation of Crimea, while Western leaders have expressed concern that Moscow will enter other Eastern European nations.

Ukraine filed a lawsuit at the United Nations' highest court demanding that Russia immediately halt its support for pro-Moscow separatists fighting in eastern Ukraine.

The Ukrainian Foreign Ministry accused Russia of "acts of terrorism and discrimination in the course of its unlawful aggression" in the filing to the International Court of Justice, according to a ministry statement issued on Monday evening.

Russia has repeatedly denied sending troops or military equipment to eastern Ukraine. In Moscow, its foreign ministry said Russia would use all available means of legal defence against the suit.

The filing itself has no direct consequences, though a finding by the court in Ukraine's favour could be enforceable in some national courts, theoretically triggering legal steps to freeze or seize Russian assets.

The Hague-based court had no immediate comment.

Kiev is also challenging Moscow's actions on its territory at the International Criminal Court and the European Court of Human Rights, while Ukrainian energy firms Ukrnafta and Stabil have asked the U.N.'s Permanent Court of Arbitration to compensate them for investments lost when Russia seized the Crimean peninsula.

Russia's foreign ministry said it had studied Ukraine's claims but that Kiev had not shown interest in dialogue with Moscow.

It added that it had sought answers from Ukraine about how the rights of ethnic Russians and Russian speakers in Ukraine were observed but that Ukraine had declined to discuss the issue in detail.

Russia annexed Crimea in March 2014, and fighting broke out in eastern Ukraine the following month between pro-Russian rebels and Ukrainian government forces, a conflict in which close to 10,000 people have been killed.

In Monday's filing, Ukraine accused Russia of violating the Terrorism Financing Convention "by supplying weapons and other forms of assistance to illegal armed groups operating on Ukrainian territory".

Among the separatists' alleged crimes, the filing cited the downing of Malaysian Airlines Flight MH 17 in 2014, the bombardment of residential areas in Mariupol and Kramatorsk, and the destruction of a civilian passenger bus near Volnovakha.

(Reporting By Anthony Deutsch and Alexander Winning; Editing by John Stonestreet)

Ukraine on Wednesday announced a state of emergency for its energy sector that could result in rolling blackouts as officials try to sharply curtail electricity use by consumers.

The decision was made at a Cabinet meeting to work out a response to a two-week strike by ultranationalists who have blocked a railroad between the coal-producing eastern regions and the rest of Ukraine.

Kiev has continued to buy a specific type of coal produced only in the Russian-backed separatist east that is needed to fuel the country’s power plants.

The exchange of goods has gone on even as a 34-month conflict has claimed more than 10,000 lives and unsettled eastern European states that were under the Kremlin’s thumb in the Cold War era and are wary of an increasingly assertive Russia.

Energy Minister Igor Nasalyk said the most immediate measure involved a call to all people to try to save power in their industries and homes.

But he also warned that energy conservation efforts may not be enough.

Nasalyk said that “we will implement rolling blackouts to balance out the work of Ukraine’s energy system” if the power savings are not sufficient.

The far-right protesters defend their actions by saying Kiev should not be trading with militias who are trying to carve out their own fiefdom near Ukraine’s border with Russia.

Ukraine’s pro-Western leaders have refused to break up the railroad blockades for fear of sparking a backlash among a large proportion of the population that is sympathetic to the protesters’ cause.

Nasalyk said the coming weeks would see Ukraine rely more heavily on plants that use natural gas to produce electricity and limit the use of coal.

Prime Minister Volodymyr Groysman told the meeting that the railroad protest was a “crime.”

“These blockages could leave hospitals and Ukrainian homes without power,” Groysman said.

“But fighting ordinary people is inadmissable,” he added.

The prime minister said he was also willing to fight “contraband” allegedly being transported along the railroad by the rebels.

The protesters believe that the insurgents use train cars to carry guns and soldiers to specific flash points and have entered enemy territory to stop the trains’ movements.