Category: Security

Several cyber-crime cases dismantled by Romanian police in cooperation with international law enforcement show that the Eastern European country is still a hub for cyber-related crime.

Italian and Romanian police recently dismantled a cybercrime gang that stole 1 million euros from hundreds of customers of two major European banks, Europol announced on Thursday.

Police arrested 20 suspects, nine in Romania and 11 in Italy, after a two-year investigation.

The organised crime group was essentially comprised of Italian nationals used phishing emails impersonating tax authorities to harvest the online banking credentials of their victims and then transferring the money to Romania.

The money was withdrawn from ATMs in Romania with credit or debit cards linked to the criminal accounts. Europol said they are also suspected of money laundering, drug and human trafficking, prostitution and of participation in a criminal organisation.

A wave of high-profile cyber-crime cases, including an unemployed Romanian taxi driver who called himself “Guccifer” and hacked the emails of former US Secretary of State Colin Powell and former President George W Bush in 2011, have also put a spotlight on the dark side of Romania’s growing IT industry.

After the US Embassy said that in 2011 alone Romanian hackers stole 1 billion dollars from Americans, US law enforcement authorities have in recent years kept in close contact with cybercrime units in Bucharest.

A Romanian national, Nicolae Popescu, is the second most wanted on the FBI’s cybercrime list, with a 1-million-dollar reward for his arrest.

He escaped arrest in 2010, before the Romanian police could produce a warrant. Popescu was involved with an estimated 250 Romanians in the “Valley of the Kings” case, the country’s biggest cybercrime bust; the perpetrators allegedly stole 750.000 euros by faking auctions on e-Bay.

The FBI put Popescu on the wanted list in 2012 after he allegedly set up a similar scheme that has sold numerous Americans fake items on various websites.

In February 2017, Romania’s Court of Appeal decided to extradite two Romanians to the US who had allegedly hacked into 123 Washington Police Department outdoor surveillance cameras just before US President Donald Trump’s inauguration. They demanded ransom money to unlock the blocked computers.

Mihail Isvanca, 25, and Eveline Cismaru, 28, were arrested in December 2017. They have been charged by a US Federal court with fraud and computer crimes.

The case was given high priority as the two Romanians’ actions impacted the US Secret Service’s mission and may have affected the security plan for the President’s inauguration.

Also, in December 2017, police in Romania arrested five suspects for allegedly spreading ransomware and renting the malware from an outfit on the Dark Web.

According to Europol, Romanian police have worked with Dutch counterparts and public prosecutor’s offices, as well as with law enforcement agencies in the UK and the US.

Europol says that in early 2017, the Dutch High Tech Crime Unit tipped off Romanian authorities about a group of Romanian nationals who were behind a wave of spam that pretended to originate from well-known companies in countries such as Italy, the Netherlands and the UK.

Europol says the operation identified more than 170 victims from several European countries.

With the fifth fastest internet speed in the world, Romania is one of the EU countries most vulnerable to cybercrime, according to studies.

In September 2017 it ranked third, after Malta and Greece in a vulnerability index published by Website Builder Expert, WBE.

However, Romanian authorities have developed cyber-crime fighting units that have been cooperating well in international cases.

Romanian police cooperated in a Europol led case to break up a a cybercrime syndicate of Ukrainian and Russian nationals that allegedly stole more than 1 billion euros from bank accounts over five years.

Since 2014, Romania has also led a NATO cybercrime defence unit that counters cyber attacks from Russia in Ukraine.

The innocent sounding email reached an official of the Montenegrin Defence Ministry in early January 2017.

Entitled: “NATO_secretary_meeting.doc”, it sounded like a communiqué from the Western alliance that Montenegro was soon to join.

However, IT experts say the message was not sent by NATO to update Montenegro on useful information.

It came from a notorious Russian hacking group, which wanted to break into the government’s IT systems and steal state secrets.

Also in January, according to BIRN sources, the Podgorica government received two more similar emails.

The subject line of the first read: “Draft schedule for British army groups’ visit to Montenegro”.

The title of the other was: “Schedule for a European military transfer program”.

All are believed to have come from the same Russian hacker group, which experts say is linked to the Kremlin.

Three international IT security companies say the emails came from APT28, also known as Fancy Bear, which US intelligence services say is connected to the Russian military intelligence service, GRU.

European Union officials also believe that Montenegro suffered a serious cyber attack in June 2017.

Over the last two years, Montenegro authorities have recorded a sharp rise in the number of cyber attacks, mostly targeting state institutions and media outlets.

From only 22 such incidents in 2013, almost 400 were recorded in only nine months of 2017, official data obtained by CIN-CG/ BIRN show.

Not all are related to malware viruses or attacks on state institutions, and not all the attacks can be attributed to Fancy Bear.

But many of the attacks are believed to be linked to the tiny Adriatic country’s decision to join NATO, which infuriated the country’s old ally, Russia.

Montenegro has since tightened up cyber security defences. It has formed a specialised police taskforce to fight cyber crime.

But with only limited resources, the team greatly depends on the help of NATO and other Western countries.

“After serial attacks in early 2017 we sought help from NATO and the UK to help us fight back. We succeed in reducing the damage and repelled two attacks in late 2017,” a senior police officer told CIN-CG/ BIRN, declining to provide details of those actions.

CIN-CG/BIRN’s investigation shows that the rise in cyber attacks coincided with the final phase of the country’s NATO accession negotiations in late 2016.

In addition, Montenegro’s leaders say Russia tried to interfere in the country’s October 16, 2016 general elections, a charge that Moscow has denied.

The authorities and the ruling parties claim that Russia sponsored a coup attempt on the election day.

Several Western governments, including the UK, support that interpretation of events.

The government’s critics, however, insist the coup attempt was faked, and was staged to help the veteran pro-Western leader Milo Djukanovic stay in power.

Bear leaves its tracks:

Three prominent international security companies, Fire Eye, Trend Micro and ESET agree that Fancy Bear staged at least three separate attacks in January, February and June 2017.

Upsurge feared ahead of election:
Ahead of this April’s presidential election in Montenegro, experts warn that the country may experience more cyber threats.
On April 15, citizens will elect anew president, as Filip Vujanovic, is completing his final term and cannot be re-elected.
“Russia has strongly opposed Montenegro’s NATO accession process, so it is likely to continue using cyber capabilities to undermine Montenegro’s role in the alliance,” Pierluigi Paganini, from ENISA, warned. 

So-called “lures” – spearphishing emails – are common tactics used by the group to target victims who are tempted to open messages mentioning specific topics relevant to them.

Targets are fooled into believing the email is legitimate. Then, by clicking on the link or attached document, they enable a virus to enter their computers.

Ben Read, from the US security company Fire Eye, told CIN-CG/ BIRN that the emails sent to the Montenegrin Defence Ministry in January 2017 were designed to cause chaos.

“If you opened [them], they would install the malware Game Fish on the victim’s system. That’s signature malware for APT28,” he explained.

He said experts from Fire Eye believed the hackers’ motive was Russia’s deep displeasure over Montenegro’s NATO accession, and the cyber attacks formed part of a broader plan to destabilise the country.

In January 2017, Fire Eye published a report claiming that Fancy Bear primarily targeted entities in the US, Europe, and the countries of the former Soviet Union, including government and military targets, along with defence departments, media outlets, and political dissidents or figures opposed to the Russian government.

“Russia is attacking these governments using both traditional means and as cyber-attacks,” Read added.

Before January 2017, on election day in October 2016, many websites in Montenegro were suddenly taken down by so-called DDoS attacks, in which multiple compromised computer systems attack a website and cause a denial of service for users.

However, the authorities never disclosed what actually happened on that day although they announced a detailed investigation, hinting at a Russian role in the large-scale internet incident.

Four days after the elections, on October 20, 2016, another phishing attack was launched against the parliament of Montenegro, most likely by Fancy Bear again, according to IT security specialists Trend Micro.

But, government sources told CIN-CG/BIRN that this attack was less serious, as it targeted the “wrong location”, the parliament, which does not deal with confidential data.

“It was a blind shot,” said this official who insisted on remain anonymous.

A bigger attack, which the Montenegro government describes as more intense than the one in October 2016, started on February 15, 2017 and peaked over the following days, government sources told CIN-CG/BIRN last year.

This time, websites of the government and state institutions, as well as some pro-government media, suffered a wave of cyber-attacks, officials in Podgorica told CIN-CG/ BIRN.

“The scope and diversity of the attacks, and the fact that they were being undertaken on a professional level, indicates that this was a synchronised action,” an official said.

The next attack, which a European official attributed to the same Russian source, happened in June 2017.

Pierluigi Paganini, member of the European Union’s Agency for Network and Information Security, ENISA, told CIN-CG/ BIRN that Montenegrin infrastructure was again targeted by APT28, or Fancy Bear.

“In June 2017, after Montenegro officially joined NATO, the attacks continued; experts at the security firm Fire Eye who analyzed them collected evidence that confirmed the involvement of Russia’s APT,” Paganini said.

He added that the evidence included artefacts, malware, bait documents and exploit codes.

He said that although attribution is always the most difficult part of a forensic investigation, in this case, the information gathered “points directly to the Russian APT28 group”.

BIRN asked the Russian Foreign Ministry about its connections to the group and to its attacks on Montenegro.

It refused to respond specifically, noting only that “the mentioned issues were repeatedly commented on by the Russian Foreign Ministry”.

Russia strongly denies that its state plays any role in hacking governments, media or elections across the globe.

Russian President Vladimir Putin told reporters in June 2017 that hacking groups, like artists, do their own bidding.

“Hackers are like artists who choose their targets, depending how they feel when they wake up in the morning. No such attacks could alter the result of elections in Europe, America or elsewhere,” Putin told reporters.

Attacks disrupted Facebook services:
Major cyber disruption was noted in Montenegro on election day, on  October 16, 2016, when people in Montenegro were unable to use services  such as Viber and WhatsApp.
The  government had to obtain permission from the Higher Court in Podgorica  to temporarily block these applications for two hours on the election  day and request a thorough investigation of the cyber attack.
 Facebook detected this incident in its Transparency report under the title “Internet Disruptions”.
“We are aware of a disruption affecting access to Facebook products and  services in Montenegro that took place during October 2016. This  disruption impacted messaging services and coincided with the country’s  parliamentary elections,” it said.   

Cheap way of collecting intelligence:

America disagrees. In a report, published on December 29, 2016, the US Department of Homeland Security, DHS, and the FBI insisted that the Kremlin sponsored Fancy Bear.

Fancy Bear has targeted many important international groups and individuals.

They include Germany’s ruling Christian Democratic Union, CDU, the German Bundestag, NATO, the World Anti-Doping Agency, the US Democratic National Committee, the former White House senior official John Podesta, the US Democratic Congressional Campaign Committee, and others.

Christopher Bing, Associate Editor of CyberScoop, a US cybersecurity website that has followed the attacks in Montenegro, agreed that Fancy Bear has subjected the Balkans to an intensive campaign of cyber-espionage.

“These activities largely serve as a cheap and effective way to collect intelligence remotely and covertly – without getting caught,” he told CIN-CG/ BIRN.

Bing explained that APT28 is a politically motivated threat group that is known to target geopolitical rivals of the Kremlin.

“APT28 is known to target military, governmental and civil society groups that are commonly of interest to the Russian state.

“As part of this targeting pattern, the Balkans represents a territory where Russia remains interested in controlling and asserting its dominance,” Bing explained.

The IT company ESET, known for its anti-virus and firewall products, also confirmed to CIN-CG/BIRN that Fancy Bear was on active manoeuvres in the Balkans during summer 2017.

Not all cyber attacks are Russian:

New analysis by the Public Administration Ministry on cyber threat to Montenegro showed the number of hacking attacks rose in 2017. The attacks were also “much more serious and sophisticated,” it said.

Over 380 attacks on websites, state institutions, online fraud and misuse of personal accounts were reported in 2017. That compared with just six in 2012. The authorities promised to investigate the background to all those attacks.

“The severity and sophistication of cyber-attacks affecting Montenegro during 2017 were reflected in the increased number of identified attacks on infrastructure and cyber espionage cases, as well as through phishing campaigns that targeted civil servants,” the ministry report said.

These attacks caught Montenegro on the hop, as its small cyber security team had no experience of dealing with attacks on this scale. It has only a dozen employees, who are being trained by US and UK cyber experts.

Amid reports that Russian hackers played a role in downing several websites on election day in Montenegro, the government in December adopted new measures to tighten cyber security.

It said it would strengthen the capacity of the police and intelligence services to prevent hacking, after the attacks on election day had highlighted the vulnerability of the entire system.

“It not just Russian hackers that they are dealing with. The small, under-equipped team is also dealing with the increase in online bank frauds and other attacks that do not have political background,” a government official told CIN-CG/BIRN.

Marko Barovic was always on the wrong side of the law. Growing up in Montenegro, since his teenage years he always hung out with the bad guys.

Not even 30, he already has a conviction for robbery and attempted murder. Now, since April this year, he also has a conviction for taking part in a foreign military conflict, in Ukraine, which is forbidden by law in Montenegro.

Barovic is now serving his three year and six months long prison sentence.

In 2014, as warfare erupted in Ukraine between pro–Russian separatists in the east and Ukrainian fighters, many Russian sympathisers from the Balkans, mostly from Serbia, or Serbs from Bosnia and Herzegovina and Montenegro, joined pro-Russian paramilitary units operating in eastern Ukraine, mainly in the Donetsk area.

According to the court records, Barovic travelled in December 2014 to Russia, and then, just before New Year, to eastern Ukraine, where he got a military card from the self-proclaimed Donetsk People’s Republic.

According to the same military card, he served there initially as a driver and later as a sniper. In October 2015, however, he was arrested on the border between Ukraine and Russia.

Montenegrin prosecutors say the key proof that he fought in Ukraine and did not just drive a truck, as he claimed initially at the trial, was his Facebook profile.

He often posted photos from the battlefield of himself in uniform and holding a rifle. The posts and photos, which were public, were admitted as evidence before the court in Podgorica.

After being confronted with the evidence, Barovic confessed about he had really spent his time in Ukraine. However, he still defended his conduct. He said he had gone there to “help people for moral and patriotic reasons.”

Serbs flocked to help Russian ‘brothers’:

The verdict in April this year against Barovic was a landmark conviction in Montenegro, following the adoption of a law in 2015 that classified fighting on foreign territory as a crime.

In neighbouring Serbia, however, where the number of those who fought in Ukraine as foreign fighters was much higher, there have been no such trials, but only plea agreements.

Around 24 fighters who returned to Serbia last year from Ukraine admitted guilt after the prosecution produced evidence of their presence on battlefields.

Investigators mostly gathered this evidence also by examining their social media profiles.

Plea agreements are not public documents in Serbia, but BIRN sources from prosecutors’ offices say YouTube videos and Facebook photos proved the key evidence in most cases.

The most prominent case was against Radomir Pocuca, a former special police spokesperson, who over several months of fighting in Ukraine posted almost daily videos, photos and other entries related to his time in Donetsk.

Pocuca also claimed that he went to help Serbia’s “Russian brothers” for patriotic reasons, mainly as payback for Russia’s support for Serbia in the dispute over the former province of Kosovo [which declared independence in 2008 – which Serbia has vowed never to recognise].

Serbs also remember that Russian fighters volunteered for the Serbian side in the 1992-5 war in Bosnia, which pitched Serbs against a combination of Croats and Bosniaks [Bosnian Muslims].

For many of the Serbian fighters in Ukraine, this was not their first war.

Ranko Momic, who is believed to be still in Ukraine, escaped trial for alleged war crimes in Kosovo and fled to Donetsk in 2015.

A Bosnian Serb, he fought also in the war on the Serbian side in Croatia in the early 1990s, before taking part in the war in Bosnia, serving in so-called “special” units, such as the notorious Serbian Volunteer Guard.

Even during the 1990s, before mobile phones or social media appeared, these fighters enjoyed being photographed or filmed during their time in battle, and local and international courts used such records to secure convictions for war crimes.

Among the other better-known Serbian fighters in Ukraine with experience in the Bosnian war is Dejan Beric.

He was recently spotted again in the Donetsk area with a new group of Serbian snipers.

Beric was brought up in Putinci, a village in northern Serbia, where he ran a business making doors and windows in the nearby town of Indjija before closing his business in 2014 and leaving for Ukraine.

Many Balkan volunteers say they joined the rebels out of a deep sympathy with Russia and a sense of Slavic Orthodox Christian brotherhood.

But Beric said that he also went there after being personally invited by two Russian volunteers who previously fought in the Balkan wars in the 1990s.

“They called on me to repay the debt, in terms of moral and human spirit,” Beric told BIRN earlier this year in an interview.

Contrary to some accounts published on the internet, Beric said that becoming a volunteer is simple; would-be fighters need only to catch a plane to Rostov-on-Don in Russia and then take a bus across the border to rebel-held Donetsk or Lugansk in Ukraine.

“I came from Sochi, where I worked, via Odessa to Sevastopol, where I became a member of the ‘Defence of Sevastopol’… Then I went to Donbass,” Beric recalled. 

Beric also regularly updates his Facebook and YouTube account with stories from the battlefield.

Many fighters remain on the run:

Social media profiles did not only help the authorities in Serbia and Montenegro to secure convictions; Ukrainian authorities have also used them to issue arrest warrants against the remaining Serbian fighters in the country.

Ukraine’s security service has issued arrest warrants against six Serbian mercenaries, while Kiev authorities maintain that almost 300 Serbs remain fighting in various rebel areas.

The six Serbs, according to Ukraine’s security service, fought in Ukraine in 2014 and then in Syria – another conflict zone in which Russia is deeply involved – in 2015.

All six allegedly belong to Wagner, a military company registered in Argentina, which the Ukrainian security service says serves as a paramilitary unit tasked with fighting for Russian interests across the world.

Among the six fighters wanted by Ukraine is Davor Savicic “Elvis”, a Bosnian Serb, who claims to live in Russia and work on a construction site.

Savicic was reportedly highly appreciated by his superiors at Wagner due to his extensive battlefield experience, and given the codename “Wolf” to reflect his strength and courage in combat.

While these claims could not be independently verified, Savicic’s Facebook profile picture is also, by coincidence, a wolf.

Bosnian police told BIRN that they believe that the mercenaries have a meeting point in Moscow, and that most of them are registered as temporary workers in Russia in order to avoid prosecution at home as foreign fighters.

Police records suggest that Savicic belonged earlier to various Bosnian Serb units, and spent the longest time fighting alongside the so-called Tigers, a notorious paramilitary unit led by Zeljko Raznatovic “Arkan”.

He who was killed in 2000 before he could face trial for war crimes by the international criminal tribunal for former Yugoslavia, ICTY, in the Hague.

In 2001, the Montenegrin prosecution accused Savicic and three others of planting a bomb in the house of Dusko Martinovic in the town of Berane, which killed six people. Martinovic allegedly owed them around 15,000 euros.

Savicic was initially jailed for 20 years in absentia in Montenegro, but an appeal court ruled later that there was not enough evidence to prove that he was responsible for the bombing.

From 2001 until his acquittal in 2014, Montenegrin police tracked him from Bosnia to France, Spain and Russia, but never managed to arrest him.

The same year Savicic was cleared, photographs appeared of him on the frontline in Lugansk, after he and an estimated 50 other Serbian fighters brought their battlefield skills to the aid of pro-Russian rebels against the Ukrainian government, according to the Bosnian prosecution.

Russia appears to have deployed them using similar methods to those Serbia used in the Bosnian war, when Serbia denied any direct involvement in the conflict and insisted all the Serbian citizens who took part in it were volunteers. Russia has done the same in Ukraine.

Wagner fighters have also fought for Russia’s Syrian ally, President Assad, and although many of them have denied the reports, news from Syria suggests that a number of them lost their lives fighting Assad’s jihadist foes.

Among them was Dimitrije Sasa Jojic whose death aged 25 was announced this June by the Serbian football fan group Firma, to which Jojic belonged before taking the path of a foreign mercenary.

Jojic also initially fought in Ukraine and had been active on social media there, posing in uniform and with other fighters.

It is believed that he was part of the same group from Wagner that went to Syria. Jojic was buried in Moscow this summer.

Other Serbian fighters, allegedly members of Wagner, and also wanted by Ukraine are believed to be stationed in Russia, travelling occasionally to rebel-held areas of Ukraine. All of them have Serbian or Bosnian passports.

Unlike Barovic or Pocuca – who were extradited from Ukraine and Russia – the Wagner men are seen as far more important for both sides in the conflict.

They are important for Russia, as their methods shed light on the hidden ways Russia exports fighters to the conflict zone.

They are equally important for Ukraine, which hold them responsible for numerous attacks that killed hundreds of people.

In consequence, as security experts have told BIRN, their extradition and arrest is highly unlikely.