Vulkan files leak

The Vulkan files are a collection of thousands of leaked documents from the Russian cybersecurity company NTC Vulkan (Russian: НТЦ Вулкан), a contractor for Russian military and intelligence agencies. Dating from 2016 to 2021, the files describe software developed by Vulkan to support Russian cyberwarfare and information warfare, including systems for identifying vulnerabilities in computer networks, coordinating cyber operations, controlling internet and telecommunications traffic in designated areas, and conducting disinformation campaigns through social media. The activities include political interference in foreign affairs (such as in the 2016 United States presidential election).

Among the projects revealed by the files were Skan, designed to identify and catalogue vulnerable computer systems; Amezit, a system combining internet surveillance and control with tools for online disinformation; and Crystal-2, a training platform for cyber operations against transportation and other critical infrastructure. The documents link Vulkan's work to several Russian security and intelligence organizations, including the Federal Security Service (FSB), Foreign Intelligence Service (SVR) and the military GRU, and contain evidence connecting its projects to GRU Unit 74455, associated with the Sandworm hacking group.

The documents were leaked to the German newspaper Süddeutsche Zeitung shortly after the beginning of the Russian invasion of Ukraine in February 2022 by an anonymous whistleblower who said they opposed the war. They were subsequently investigated by an international consortium of news organizations and first reported publicly in March 2023. Five Western intelligence agencies and several independent cybersecurity experts assessed the documents as authentic. The files provide evidence of the development and testing of Russian cyberwarfare capabilities, but do not establish that every system described became operational or directly connect Vulkan's software to particular known cyberattacks.

Background

The company NTC Vulkan was founded by Anton Markov and Alexander Irzhavsky in 2010. Both are graduates of St Petersburg military academy and have served in the Russian army, with Markov reaching the rank of captain and Irzhavsky reaching the rank of major.

Vulkan received special licences to work on classified military and state projects from 2011. Vulkan held an FSB security licence allowing it to undertake classified work, and FSB officers were also stationed within the company.

It has more than 120 staff, 60 of whom are programmers, and describes its speciality as information security. It lists Sberbank, Aeroflot and Russian Railways as customers.

Leaks

The documents, numbering in their thousands, were leaked to the German newspaper Süddeutsche Zeitung within days of the 24 February 2022 Russian invasion of Ukraine by a whistleblower who opposed that war, and were analysed by journalists from that publication and The Guardian, Le Monde and Washington Post, with several other media outlets, as part of a consortium led by Paper Trail Media and Der Spiegel. The consortium published the first details of its investigation on 30 March 2023.

Five Western intelligence agencies and several independent cybersecurity experts authenticated the files.

Contents

The cache consists of more than 5,000 pages of documents dating from 2016 to 2021, including internal emails, contracts, financial records, manuals and technical specifications for software developed by Vulkan for Russian military and intelligence agencies. The documents describe systems intended to automate disinformation campaigns, identify and catalogue vulnerabilities in computer networks, coordinate cyber operations and monitor or control internet activity. They also contain documentation concerning the testing of systems and payments made to Vulkan by Russian security services and associated research institutes. Financial records independently obtained by the journalists matched references in the documents and showed millions of dollars in transactions between Vulkan and known Russian military/intelligence organizations. Experts described contractors like Vulkan as an important part of GRU offensive cyber R&D, supplying capabilities and expertise to state agencies.

The documents do not contain malware source code, verified lists of intended targets or evidence directly connecting the Vulkan systems with known Russian cyberattacks. Western intelligence officials and cybersecurity researchers therefore cautioned that it was unclear which systems had become operational. However, references to government testing, requested modifications and completed projects indicated that at least trial versions of some systems had been deployed.

Amezit

Vulkan won an initial contract to create a system called Amezit in 2016. Amezit was designed to enable its operator to control internet and telecommunications traffic within a designated area, including mobile networks and social media. The system could be used to isolate such an area from external communications and impose an information blackout. A subsystem known as PRR was intended to disseminate disinformation through social media.

The documents describe methods for automatically creating large numbers of fake social-media accounts, including the use of banks of SIM cards to circumvent account-verification procedures on services such as Facebook and Twitter. A 2017 draft manual also described the preparation, distribution and promotion of propaganda material through social media, telephone calls, emails and text messages.

Journalists examining Twitter accounts identified in the leaked documents found evidence suggesting that the tools had been used in several countries. Examples included accounts promoting narratives associated with Russian state propaganda concerning the Syrian civil war and, during the 2016 United States presidential election, material attacking Hillary Clinton. Amezit also contained functions for surveillance and control of internet access in areas under Russian control. Project documents described an "information restriction of the local area" and the creation of an autonomous segment of a data-transmission network. Mock-ups showed the system mapping computer networks associated with physical infrastructure. Examples used in the documentation included the Swiss Foreign Ministry in Bern and the Mühleberg Nuclear Power Plant, with technical information concerning potential means of gaining access to their networks, although cybersecurity experts cautioned that these examples did not constitute evidence that the facilities were actual Russian targets.

In 2018 some NTC Vulkan employees went in connection to Amezit to Rostov-on-Don to visit the Radio Research Institute, which is linked to the Federal Security Service. According to Russian security-services expert Andrei Soldatov, however, the institute was acting as an intermediary for the Russian military, which was the intended user of the system. Development of Amezit began six years before the 2022 Russian invasion of Ukraine, indicating that the Russian military's interest in systems combining territorial communications control, censorship and disinformation predated the invasion. It is not known if it has been used in parts of Ukraine occupied by the Russian Army.

Internal emails indicate that Russian intelligence customers were testing Amezit by 2020. A May 2019 email recorded customer feedback and requested modifications, while an associated spreadsheet recorded components of the project as completed.

Crystal-2

The documents also describe Crystal-2, a cyberwarfare training platform that Vulkan was contracted to develop in 2018 to support searching for weak spots in systems to be targeted. Scan-V was commissioned in May 2018.

It was intended to allow up to 30 trainees to operate simultaneously. Its documentation described exercises involving the use of Amezit to disable control systems for rail, air and maritime transportation, as well as training in methods for obtaining unauthorized access to local computer and technological networks supporting infrastructure in populated and industrial areas. The documentation classified information processed and stored by the system as "Top Secret". It is unclear whether the proposed training programme became operational.

Skan

Skan was designed to continuously scan the Internet for vulnerable computer systems and compile information about them in a database for possible future cyber operations. A 2019 document described the system as capable of displaying possible attack scenarios and identifying network nodes that could be involved in them. It was also intended to permit data exchange between geographically dispersed Russian cyber units.

The leaked correspondence provides evidence that at least part of Skan was delivered to a Russian military customer. In May 2020, a Vulkan developer discussed sending company personnel to the premises of the project's "functional user" to install and configure equipment and software and demonstrate the system. The location was identified as Khimki, the Moscow suburb in which the GRU unit associated with the Sandworm hacking group is based.

Another leaked document dated 2019 refers to Sandworm's military unit number, 74455, and records an official from the unit approving a data-transfer protocol for one of Vulkan's platforms. Cybersecurity analysts regarded this as evidence that Vulkan was developing software for the GRU hacking unit.

Connections with other organisations

The documents link Vulkan to the Cozy Bear hacker group, according to Google researchers.

External links

• "Putins Krieg im Netz [Putin's Cyber-War]". Der Spiegel (in German). Hamburg, Germany.