Companies Linked to Russian Ransomware Hide in Plain Sight The New York Times


One of their greatest areas of impact on the Russian defense industry is its resulting tech shortage. Export controls have hampered Russia’s ability to sustain, repair, and resupply its weaponry. In response to the invasion, American support neon womens running shoes for Ukraine was immediate and unwavering, committing billions of dollars in security assistance to counter Russian aggression. Along with allies and partners, we also imposed severe economic costs on Russia to hobble its war machine.

There is little to be seen from outside other than a pleasant roof garden. And in August 2018, Russia created two offshore zones known as special administrative regions , designed to entice Russia’s largest firms to redomicile in the country by offering tax incentives and a safe haven from U.S. sanctions. By Forbes’ count, Deripaska and Vekselberg both transferred at least 14 companies, including En+ Group and aluminum giant Rusal, from offshore jurisdictions such as Jersey and Cyprus to Russian SARs. Treasury Department in April 2018, but he still owns at least three properties in the U.S., including two homes in Manhattan and a mansion in Washington, D.C., thanks to three LLCs based in Delaware. Two of the homes were raided by the FBI in October 2021, but a spokesperson for Deripaska has repeatedly said the properties are owned by Deripaska’s relatives. Another Russian billionaire sanctioned by the U.S. in 2018, Viktor Vekselberg, still owns a home in suburban Connecticut and a luxury condo in Manhattan through his wife, Marina Dobrynina.

Today, the Department of State and the Department of Treasury have taken additional sweeping actions as part of our response, together with our allies and partners, to the premeditated, unprovoked Russian war against Ukraine. These actions make it clear that there is nowhere to hide for individuals and entities that support Russia’s aggression against Ukraine. A .gov website belongs to an official government organization in the United States. At the time of initial publication, the bit.ly link had just 17 clicks, which the researchers say “might indicate that it was only a test run.” “The fact that the Turla actors are using social media as a way to obtain its is quite interesting,” the researchers said. “This behavior has already been observed in the past by other threat crews such as the Dukes.”

Some of this money finds it way to financial capitals such as New York and London, where it can be invested and reap returns. Nizhny Novgorod Aviation Plant Sokol is a Russian defense entity that develops fighter aircraft for the Russian military. ODK-UMPO Engine Building Enterprise is a Russian defense entity that produces engines for fighter aircraft for the Russian military. Irkutsk Aviation Plant is a Russian defense entity that produces fighter aircraft for the Russian military. Joint Stock Company Salavat Chemical Plant manufactures products for the enterprises of the Russian Ministry of Defense and has described itself as a leading chemical enterprise of Russia’s defense industrial complex.

On the same day he was hit by EU sanctions last week, steel baron Alexey Mordashov transferred his majority stake in U.K.-based gold-mining firm Nordgold to his wife, Marina. “Russian troll accounts purged by Twitter pushed Qanon and other conspiracy theories”. “The notorious Kremlin-linked ‘troll farm’ and the Russians trying to take it down”. The IRA’s “United Muslims of America” Facebook group organized the “Make peace, not war!” protest on 3 June 2017, outside Trump Tower in New York City.

Unit 42 remains vigilant in monitoring the evolving situation in Ukraine and continues to actively hunt for indicators to put protections in place to defend our customers anywhere in the world. We encourage all organizations to leverage this research to hunt for and defend against this threat. The total number of IPs translates to the introduction of roughly two new IP addresses every day into Gamaredon’s malicious infrastructure pool. Monitoring this pool, it appears that the actors are activating new domains, using them for a few days, and then adding the domains to a pool of domains that are rotated across various IP infrastructure. This shell game approach affords a degree of obfuscation to attempt to hide from cybersecurity researchers. Evidence of its use in a Gamaredon campaign was flagged by a researcher as far back as 2019.

In total, the trove consists of 11.9m files leaked from a total of 14 offshore service providers, totalling 2.94 terabytes of information. That makes it larger in volume than both the Panama papers and Paradise papers , two previous offshore leaks. Russian bloggers Anton Nosik, Rustem Adagamov, and Dmitriy Aleshkovskiy have said that paid Internet-trolls don’t change public opinion.

Since Russia’s invasion of Ukraine, countries around the world have been using sanctions and new laws to try find this “dark money”, hoping to damage the oligarchs close to President Putin. Joint Stock Company ODK-Klimov is a Russian defense entity that produces engines for attack helicopters for the Russian military. UEC-Saturn is a Russian defense entity that produces engines for Russia’s military, including for military aviation and frigates. JSC Research and Production Association Kvant is a Russian defense company that produces electronic warfare systems whose electronic warfare systems have been used by Russian-backed forces involved in the destabilization of Ukraine. “The one that was used in the analyzed sample was a comment about a photo posted to the Britney Spears official Instagram account,” they added. “The extension will look at each photo’s comment and will compute a custom hash value.”