U.S. intelligence got the wrong cyber bear

The version of PAS identified in the U.S. government report is several versions behind the current one.

“One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources,” wrote Mark Maunder of Wordfence.

Again, that’s not necessarily a reasonable expectation. Any hacker, whether associated with Russian intelligence or not, can use any tools he or she might find convenient, including an old version of a free, Ukrainian-developed program. Even Xagent, a backdoor firmly associated with attacks by a hacker group linked to Russian intelligence — the one known as Advanced Persistent Threat 28 or Fancy Bear — could be used by pretty much anyone with the technical knowledge to do so. In October 2016, the cybersecurity firm ESET published a report claiming it had been able to retrieve the entire source code of that malicious software. If ESET could obtain it, others could have done it, too.

Now that the U.S. government has firmly linked PAS to Russian government-sponsored hackers, it’s an invitation for any small-time malicious actor to use it (or Xagent, also mentioned in the DHS-FBI report) and pass off any mischief as Russian intelligence activity. The U.S. government didn’t help things by publishing a list of IP addresses associated with Russian attacks. Most of them have no obvious link to Russia, and a number are exit nodes on the anonymous Tor network, part of the infrastructure of the Dark Web. Anyone, anywhere could have used them.