A SERIES OF LARGE-scale incidents of destruction, which have been occurring across Russia in recent days, are prompting speculation that the county may be experiencing a wave of attacks against its strategic infrastructure. The incidents include enormous fires at power plants, munition depots and state-owned storage facilities. The collapse of at least one railway bridge has also been reported. There are additional reports of massive wildfires raging across Siberia, which are imposing heavy demands on Russia’s emergency response infrastructure. On April 21, a massive blaze engulfed the Central Research Institute for Air and Space Defense of the Russian Defense Ministry in Tver, a city located around 120 miles northwest of Moscow. According to Associated Press, which reported the news about the fire, the institute “was involved in the development of some of the state-of-the-art Russian weapons systems, reportedly including the Iskander missile”. By next morning, at least 17 people were believed to have died as a result of the fire. Late last week, the Sakhalinskaya GRES-2 power station, a vast 120-megawatt coal-fired power plant in Russia’s far-eastern Sakhalin province, went up in flames, giving rise to persistent rumors of sabotage. On May 1, Russian state-owned news agencies reported that a railway bridge in the western province of Kursk, 70 miles from the Ukrainian border, had been destroyed. Analysts at the Washington-based Atlantic Council think tank claimed that the bridge had been used extensively by the Russian military to transport equipment to eastern Ukraine. Later on the same day, a cluster of fuel-oil tanks in Mytishchi, a mid-size city located northeast of Moscow, were completely destroyed by a fast-spreading fire. On May 2, a munitions factory in Perm, a major urban center in western Siberia, was hit by a “powerful” explosion. Ukrainian government officials hinted at sabotage in social media posts, though no proof has been provided, and the Kremlin has not commented on the matter. On the following day, the Prosveshchenie publishing house warehouse in Bogorodskoye, northeast of Moscow, was destroyed by a massive fire. The warehouse belongs to Russia’s state-owned publisher of school textbooks. The fire occurred almost simultaneously as another fire engulfed a polyethylene waste storage facility in the central Siberian city of Krasnoyarsk. Meanwhile, the sprawling forests that surround Krasnoyarsk and other Siberian urban centers are experiencing seasonal wildfires of near-unprecedented scale. Some early reports claimed that the Russian government was finding it difficult to contain these fires, because the country’s emergency response personnel has been sent to the frontlines of the war in Ukraine. But these reports were denied by Russia’s Ministry of Emergency Situations, which claimed earlier this week that the fires were mostly under control. ► Author: Joseph Fitsanakis | Updated: 09 May 2022 | Research credit: M.R. | Permalink

A NEWLY DISCOVERED CYBER-espionage group appears to target the senior leadership of private corporations involved in large-scale financial transactions, but employs skills and methods that are usually associated with state-sponsored threat actors. The group has been termed “UNC3524” by the American cybersecurity firm Mandiant, which says it discovered it in December of 2019. In a detailed blog post published earlier this week, a team of cyber-security researchers at Mandiant say they have been studying the group for over two years, and have been surprised by their findings. Given its targets, as well as the information it goes after, there is little doubt that UNC3524 is interested in financial gain. However, its operational profile differs markedly from those of other financially oriented hacker groups, according to Mandiant. Its sophisticated approach to espionage demonstrates aspects that are typically associated with government-sponsored intelligence operations. Notably, UNC3524 operatives take their time to get to know their targets, and are not in a hurry to exploit the online environments they penetrate. Mandiant reported that UNC3524 attacks can take up to 18 months to conclude. In contrast, the average financially-motivated cyber-espionage attack rarely lasts longer than three weeks. Additionally, UNC3524 operatives make a point of maintaining an extremely stealthy and low-key online profile, and have even developed a series of novel exploitation techniques, which Mandiant has termed “QuietExit”. The latter appear to focus on exploiting Internet of Things (IoT) devices that are typically found in corporate settings, but are not protected by traditional anti-virus systems. Once they penetrate the digital environment of their target, UNC3524 operatives meticulously build sophisticated back-doors into the system, and are known to return sometimes within hours after they are detected and repelled. Interestingly, UNC3524 operatives do not waste time on low-level employees of targeted corporations. Once inside, they go straight for executive-level targets, including those in corporate strategy and development, mergers and acquisitions, and even information security. Mandiant says a few other actors, notably Russian-linked groups like Cozy Bear, Fancy Bear, APT28 or APT29, are also known to operate with such high-level targets in mind. However, there is little other operational overlap between them and UNC3524, the blog post claims. ► Author: Joseph Fitsanakis | Date: 04 May 2022 | Permalink

AUSTRALIAN INTELLIGENCE MUST recruit foreign spies with more urgency than at any time since the opening years of the Cold War, according to the head of Australia’s main foreign intelligence agency. Paul Symon, director of the Australian Secret Intelligence Service (ASIS), was speaking at a public event to mark the 70th anniversary of the organization’s history. It was a rare public speech by the head of Australia’s secretive main foreign intelligence service. Symon’s talk was hosted in Sydney by the Lowy Institute, an independent Australian think-tank that focuses on international affairs. During his talk, which was made available afterwards on the Lowy Institute’s website, Symon spoke about a range of issues relating to Australia’s geopolitical priorities and their connection to intelligence operations. He told the audience that the primary task of ASIS, which is to recruit foreign subjects to spy on behalf of Australia, remained as crucial as ever. He added, however, that a growing number of pressing concerns made “the need to recruit new spies” more essential than ever before. According to Symon, ASIS needs to “recruit and work with even more vigor and urgency than at any other point in our 70-year history”. In this task, China remains a strategic focus for ASIS, given its role in the region. Symon claimed there were signs that increasing numbers of Chinese state “officials [and] individuals” were “interested in a relationship” with ASIS. This was because many Chinese are becoming concerned about what he described as the rise of “an enforced monoculture” in China, and wish to stop it, said Symon. Later in his speech, the ASIS director touched in broad terms on the challenge posed by technology on human intelligence (HUMINT) operations, in which ASIS specializes. He described these challenges as “extraordinary”, and said they resulted from an interaction between “a complex strategic environment [and] intensified counter-intelligence efforts” by Australia’s adversaries, as well as a host of “emergent and emerging technologies”. These technologies are in many ways posing “a near-existential” risk to the types of HUMINT operations carried out by ASIS, as the organization’s collection activities run the risk of becoming “increasingly discoverable”, said Symon. ► Author: Joseph Fitsanakis | Date: 10 May 2022 | Permalink