Earlier this month, the US Department of Justice (DOJ) indictment of Russian hackers described how twelve Russian intelligence operatives allegedly used a series of cyber attacks to interfere in the 2016 US presidential election.
The DOJ’s investigation found that the attacks were facilitated by infrastructure purchased with cryptocurrency. It should perhaps come as no surprise that the hackers opted to use cryptocurrency as a means of concealing their identities. That serves as a notable fact, but even more notable is that the attempt to make their activity untraceable didn’t work.
The indictment claims that the operatives, officers of the GRU (a Russian military intelligence agency), hacked into the email accounts of employees and volunteers of the Hillary Clinton presidential campaign, as well as the computer systems of the Democratic Congressional Campaign Committee and the Democratic National Committee. Tens of thousands of documents are alleged to have been stolen in these hacks and then released using fictitious online personas, including “DCLeaks” and “Guccifer 2.0”.
Bitcoin was the primary means of payment for the infrastructure used in the hacking activities, including website domain registrations, servers and VPN services. The indictment explains that cryptocurrency was used in order to conceal connections to Russia and the Russian government, by “avoiding direct relationships with traditional financial institutions, allowing them to evade greater scrutiny of their identities and sources of funds”.
The operatives took measures to further conceal the source of these bitcoins and prevent them from being traced back to an account and tied to an individual. These included the use of peer-to-peer exchanges, transferring into and out of other cryptocurrencies, and the use of prepaid cards. The DOJ also states that the operatives mined their own bitcoins, providing them with funds with no previous transaction history on the blockchain that could be used to trace their provenance.
Combating Bad Actors with Bitcoin Blockchain Analysis
Despite the measures taken by the GRU officers, the investigators’ analysis of the bitcoin blockchain enabled them to link the online personas used to leak the stolen data back to the officers themselves:
- Analysis of the bitcoin blockchain revealed that the same pool of bitcoins used to register the dcleaks.com domain, was also used by the GRU to purchase other domains used in the GRU’s spear-phishing operations.
- Funds from the same bitcoin address were used to purchase a VPN service that was used to log into the @Guccifer_2 Twitter account, and to lease a Malaysian server that hosted the dcleaks.com website.
The indictment does not mention any specific bitcoin addresses or transaction IDs linked to this activity, however it does describe a transaction made by one of the operatives:
By searching the bitcoin blockchain for transfers of exactly this value, we can identify the specific transaction that this corresponds to, made on 1st February 2016:
Using Elliptic’s Forensic software, we can determine the source of funds used in this transaction. Elliptic has identified that the funds originated from an exchange based in Europe that allows the exchange of US Dollars, Euros, and Russian Ruble for cryptocurrencies, including bitcoin.
Foiled Again by Cryptocurrency Forensics
The DOJ indictment is not the first documented use of cryptocurrency to pay for infrastructure used in hacking by groups associated with Russian intelligence services. In late 2017, Elliptic worked with the BBC to investigate the use of bitcoin by the “Fancy Bear” cyber espionage group, which has been reported to be affiliated with the GRU, and which has been linked to the same attack on the Democratic National Committee cited in the DOJ indictment.
The DNC hack, as well as others targeting the German Parliament in 2014, attendees of the Farnborough Air Show, and numerous users of Apple devices, were linked to or perpetrated from computers rented from “Crookservers”, a server reseller based in the UK and Pakistan.
Over three years, Fancy Bear rented numerous servers from Crookservers, remaining anonymous through the use of fake identities, VPNs and bitcoin payments.
Elliptic analyzed these bitcoin transactions and was able to trace them back to a central wallet, seemingly controlled by Fancy Bear. The bitcoins in this wallet were further traced back to a number of sources including:
- BTC-e, a cryptocurrency exchange that was shut down by the US Department of Justice in July 2017. It allowed trading between the U. S. dollar, Russian ruble, euro and a variety of cryptocurrencies. Russian national Alexander Vinnik was arrested in Greece for his alleged role in running BTC-e;
- An online currency exchange, believed to be based in Slovakia, which enables the exchange of cryptocurrencies and other digital currencies such as Webmoney and Perfect Money;
- The same European cryptocurrency exchange that was identified above as the source of funds for the payment made by “gfadel47”, as detailed in the DoJ indictment.
It is clear that cryptocurrencies are emerging as a key tool to support espionage and cyber attacks perpetrated by nation states. North Korea has been linked to the Wannacry ransomware that caused major disruption around the world in May 2017, and cryptocurrency payments have been touted as a means for intelligence agencies to fund overseas agents.
The same properties of cryptocurrencies that make them attractive to criminals, such as censorship resistance, pseudonymity and the ease with which they can be transferred across borders, also make them valuable tools for all nation state actors looking to fund clandestine operations.
However, the DOJ indictment makes clear that analysis of blockchain transactions can be used to trace flows of funds, link actors together and potentially identify them. While crypto may seem appealing for engaging in illicit activity, software like Elliptic Forensics exists to help law enforcement and regulators trace flows of funds and potentially identify who is behind such acts.