Ukrainian gas company hack traced to Russia

Attacks on Burisma began same time as impeachment talk.

With President Donald Trump facing an impeachment trial over his efforts to pressure Ukraine to investigate former Vice President Joe Biden and his son Hunter, Russian military hackers have been boring into the Ukrainian gas company at the center of the affair, according to security experts.

The hacking attempts against Burisma, the Ukrainian gas company on whose board Hunter Biden served, began in early November, as talk of the Bidens, Ukraine and impeachment was dominating the news in the United States.

It is not yet clear what the hackers found, or precisely what they were searching for. But the experts say the timing and scale of the attacks suggest that the Russians could be searching for potentially embarrassing material on the Bidens — the same kind of information that Trump wanted from Ukraine when he pressed for an investigation of the Bidens and Burisma, setting off a chain of events that led to his impeachment.

The Russian tactics are strikingly similar to what American intelligence agencies say was Russia’s hacking of emails from Hillary Clinton’s campaign chairman and the Democratic National Committee during the 2016 presidential campaign. In that case, once they had the emails, the Russians used trolls to spread and spin the material, and built an echo chamber to widen its effect.

Then, as now, the Russian hackers from a military intelligence unit known formerly as the G.R.U., and to private researchers by the alias “Fancy Bear,” used so-called phishing emails that appear designed to steal user names and passwords, according to Area 1, the Silicon Valley security firm that detected the hacking. In this instance, the hackers set up fake websites that mimicked sign-in pages of Burisma subsidiaries, and have been blasting Burisma employees with emails meant to look like they are coming from inside the company.

The hackers fooled some into handing over their login credentials, and managed to get inside one of Burisma’s servers, Area 1 said.

“The attacks were successful,” said Oren Falkowitz, a co-founder of Area 1, who previously served at the National Security Agency. Falkowitz’s firm maintains a network of sensors on web servers around the globe — many known to be used by state-sponsored hackers — which gives the firm a frontrow seat to phishing attacks, and allows them to block attacks on their customers.

The Russian attacks on Burisma appear to be running parallel to an effort by Russian spies in Ukraine to dig up information that could embarrass the Bidens, according to an American security official, who spoke on the condition of anonymity to discuss sensitive intelligence.

Neither the Russian government nor Burisma responded to requests for comment.