Security Firm Reveals Russian Hackers Manipulated Ruble-Dollar Conversion Rate; Also Withdrew Via Credit Cards

February 8, 2016
Russian exchange booth. Photo by Reuters

LIVE UPDATES: Last February, Russian hackers penetrated a Russian regional bank and were able to move the ruble-dollar conversion rate more than 15% in 15 minutes, according to Group-IB, a Moscow-based cybersecurity firm hired to investigate the attack

Welcome to our column, Russia Update, where we will be closely following day-to-day developments in Russia, including the Russian government’s foreign and domestic policies.

The previous issue is here.

Recent Translations:
The Non-Hybrid War
Kashin Explains His ‘Letter to Leaders’ on ‘Fontanka Office’
TV Rain Interviews Volunteer Fighter Back from Donbass
‘I Was on Active Duty’: Interview with Captured GRU Officer Aleksandrov

UPDATES BELOW


10 Demonstrators Against a Construction Site in Moscow’s Tyoply Stan Detained After Blocking Road; 7-12 Day Sentences

Ten activists in Moscow who want to prevent construction of a high-rise building in a park in their housing complex in Tyoply Stan were detained February 6 for blocking Profsoyuznaya Street near the planned site, video blogger Sasha Sotnik reported. Eight were given jail sentences ranging from 7 to 12 days in court today, and 2 were released pending trial, according to OVDInfo.org
Translation: Today in the area of Konkovo (No. 128 Profsoyuznaya Street) once again Muscovites were dispersed. And unlawfully arrested. More...

Translation: Police broke up a rally of opponents of infill development in Tyoply Stan (PHOTO).

About 200 people had demonstrated in Tyoply Stan, a neighbourhood on the outskirts of Moscow on February 3, and then on February 6 re-convened with a local legislator — such meetings don’t require a permit. 

Translation: #Moscow In Tyoply Stan, a rally took place against an unlawful construction.

Translation: Photographs from the meeting with deputies regarding the construction of a hotel in Tyoply Stan.

But someone threw a fire cracker at the crowd. Police arrived and detained someone at random who was merely passing by; participants then tried to stop the police van in protest and were charged with disobeying police. They they decided to block Profsoyuznaya Street and ultimately 10 of them were detained.

2016-02-08 21:27:31

On February 1, the protesters had met with deputy Mikhail Gromov who had actively opposed the construction. After that meeting, some unknown persons severely beat him, and he was in the hospital at least as of February 8, said OVDInfo.

45d00497ac2a299db63b7764efc72a9e.png

Like similar stories involving struggles over scarce “green zones” in Moscow, this one has two sides. The developers use the term “infill development” to describe the rational use of what they see as an “empty lot” in a sprawling housing complex. But residents and environmental protesters say in fact a “green” area will be removed and they will face more crowded conditions and air pollution.

Furthermore, they reason, the park in question was just rebuilt for Victory Day on May 9 last year, and residents want to keep the area the way it is, with the tree-lined square and one-story buildings that house a post office, supermarket, along with other conveniences and with merchants’ stalls.  They think it’s crazy to dig up what was already built.

The activists have worked social media as best as they can to promote their cause — with a community group on VKontakte, the most popular Russian social network; with a change.org petition, with LiveJournal blog photos, and also an article explaining the background of their cause on Medium.

0_dbe46_460d44d6_-1-XXL.jpgThe graffiti on the construction site wall says “Occupiers Get Out!” Photo by LiveJournal user msk_ts.

According Sp. Jrlsm, the author of the Medium piece, back when Yury Luzhkov was still mayor of Moscow, he promised a portion of the site in Tyoply Stan to some developers who turn out to be ultimately connected to Viktor Vekselberg, one of the main oligarchs of Russia. But then this parcel suddenly doubled in size for some reason. The high-rise has been variously described as a hotel for migrants or an apartment building and is also to have an adjacent parking lot. 

1*EHuW8fRzKDNW68JjqBvpWQ.jpeg

Architect’s drawing of the residential high-rise.

As can be seen on Google maps, the site, sandwiched among existing high-rises, is not very large.

image loading...

The two marked squares show how the parcel doubled in size from its original plan:

1*IvpDI8HpNZpcRM5a0GcRZQ.jpeg

This photo shows the park at street level:

1*GmNfA-7lZqHjKg4G4aPD0A.jpeg

The issue of migrants per se is not in dispute and it’s not even certain that migrants would be moved there; rather the residents object to the doubling of the parcel and the construction in the middle of an already-crowded housing tract of yet another building, destroying the park and its easement value. To be sure, there are big forested parks in this district, but for pensioners and families with small children they are too far away to walk to conveniently. So they are fighting for their turf.

As with similar protests, such as against the building of a highway through a forest in Khimki which led to multiple detentions of protests and cost a journalist, Yury Bekhetov, his life — officials have proved impervious to their complaints and already razed the merchants’ stalls and plan to tear up the rest of the area.

0_dbdc3_b5d6757e_XXL.jpg

OVDInfo, the police monitoring site said February 7 that according to a niece of one of the detainees, while at first relatives could visit them, on February 7 they were told they could have no more visitors or packages, and their cell phones were confiscated. Some of the detainees were said to be intoxicated; the niece said that her uncle had reported that there were drunks in the police van along with the demonstrators.

Cherymushkin District Court reviewed some of the cases today and OVDInfo provided a report. Kirill Kuprin was sentenced to 10 days of jail for disobeying police orders, according to his lawyer.

Observers said Judge Bondar went into his chambers for two hours; we note that he may have had to get instructions from higher-ups through the infamous system of Russian “telephone law.”

Two other demonstrators, Mikhail Lomakin and Ivan Solomatin, received 10 and 12 days of jail, respectively.

Sergei Ulin, another protester, was sentenced to 7 days of arrest. He complained that the man who had thrown the fireworks had disrupted what was a peaceful protest.

Mikhail Saliev, yet another protester, was given 7 days’ jail sentence, and Aleksandr Uvarov was released pending trial.

Thus of the 10 detained, 8 are still being held and two are to be released pending trial, although not all the names were available. None of them were allowed to see their case files. Their lawyer was only told at the last moment what charges his clients are facing.

Now that repeat demonstrators can earn themselves 4 or 5 years in a labor colony after multiple detentions and short-term jail sentences, the protesters may be forced to give up. They were desperate enough to block a road and face jail time, but they may not be willing to spend years away from their families.

— Catherine A. Fitzpatrick 

Security Firm Reveals Russian Hackers Manipulated Ruble-Dollar Conversion Rate; Also Withdrew from Credit Cards
Last February, Russian hackers penetrated a Russian regional bank and were able to move the ruble-dollar conversion rate more than 15% in 15 minutes, according to Group-IB, a Moscow-based cybersecurity firm hired to investigate the attack, Bloomberg Business reported.
Bloomberg reported:

Russian-language hackers deployed a virus known as the Corkow Trojan to infect Kazan-based Energobank and place more than $500 million [sic] in orders at non-market rates in February 2015, Group-IB told Bloomberg, without identifying individuals behind the attack. The resulting rate swing prompted a Russian central bank investigation into potential market manipulation.

Malicious software of the type used in the attack can open a back door into computers via seemingly legitimate websites or files and then force them to carry out hackers’ orders. Corkow, which regularly updates itself to evade detection by anti-virus programs, has infiltrated 250,000 computers worldwide and infected more than 100 financial institutions, according to Group-IB, which investigated the attack on behalf of Energobank.

 

 

“This is the first documented attack using this virus and it has potential to do much more damage,” Dmitry Volkov, the head of Group-IB’s cyber intelligence department, said by phone. “Once the malware has penetrated a local network, it is sophisticated enough to infect computers that are even not connected to the Internet.”

Novaya Gazeta, an independent Russian newspaper, citing a statement on Group I-B’s web site, said that the hackers were able to place the orders for at a non-market price and get a quick reaction. Energobank has estimated its losses at 243.6 million rubles, Novaya Gazeta reported, worth about $3 million dollars today with the ruble at 78.83 to the dollar but worth about $4 million a year ago with the rate around 60.
Dmitry Volkov, head of investigations at Group I-B said in a statement on their site (translation by The Interpreter):

“This was a test attack, and did not bring the hackers significant profit. However, taking into account the interest of cyber-criminals in attacks on trading systems is constantly growing, the potential threat is enormous.”

Group-IB said in its report about the virus that this was the first such attack in world practice, when a broker was able to be hacked to create anonymous volatility in a currency market.
The hackers gained control of trading terminals at various stock markets to make trades for “more than $400 million” said Group-IB; within 14 minutes they were able to buy the US dollar for 55 rubles and sell it for 62 rubles. Before the hack, the rate had been within 60-62 rubles per dollar. As a result, the bank lost “many millions of dollars.”
The report also noted that another critical incident occurred in August 2015, when the calculation system was hacked in a system linking about 250 banks that enabled withdrawals from Visa and MasterCard at favorable rates. One of the hackers was able to withdraw several hundred million rubles with this scheme, which also deployed the trojan Corkow.

Group-IB said they were publishing their report to enable companies to step up their security against this threat.

— Catherine A. Fitzpatrick