Whose bear?

How is the case of the FSB Colonel Sergei Mikhailov with the exposure of GRU officers and Fansy Bear Cybergrouping

The most high -profile scandal of recent years, associated with the Stateizer of the Deputy Head of the Center for Information Security of the FSB (QIB), Colonel Sergey Mikhailov and his accomplices, went to the finish line.

On September 26, the Main Military Prosecutor's Office approved the indictments and transferred two criminal cases to the Moscow District District Military Court, which will be considered closed. It is one thing - in relation to Colonel Mikhailov and the former employee of the Kaspersky Laboratory Ruslan Stoyanov, who deny the guilt in the treason. The second is in relation to the subordinate Colonel Mikhailov Major of the FSB Dmitry Dokuchaev and entrepreneur Georgy Fomchenkov, who pleaded guilty and concluded pre -trial agreements on cooperation with the investigation. They have to prove repentance and confirm the sincerity of intentions, having witnessed the accusations in the trial against Mikhailov and Stoyanov.

Despite the head of the “secret”, nevertheless, information about one of the episodes, incriminated by the accused, leaked.

According to investigators, Mikhailov and his accomplices sent the materials of the criminal case (in which the methods and methods of conducting operational-search activities) the founder and general director of the Chronopay processing company Pavel Vrubblevsky and Khaker Dmitry and Igor Artimovichi were revealed.

The criminal case against Vrublevsky, who in the United States is called “Cybercriminus No. 1”, “New Gazeta” has already told.

The founder of Chronopay was accused of organizing a DDOS attack on the payment system of the competing company Assist in July 2010, because of which the possibility of purchasing electronic tickets for flights was blocked for several days. In 2013, the Tushino district court of Moscow issued a conviction and sent Vrubblevsky and Dmitry Artimovich to the colony (Igor Artimovich disappeared). True, not for DDOS Ataku, but for unlawful access to computer information (Article 272 of the Criminal Code of the Russian Federation).

The operational support of the criminal case against Vrubblevsky and the Artimovich brothers was carried out by the FSB QIB, the group was personally led by Colonel Mikhailov. By the way, during the trial, Mikhailov came to the Tushino district court, where I met him, in vain trying to get at least some comments on the criminal case that looked as fabricated.

Today, after five years, it turns out: Mikhailov is charged with that he recorded all the materials of the Vrubblevsky case on two CDs. He handed one copy to Major Dokuchaev. Dokuchaev handed over the disc an employee of the Kaspersky Laboratory Ruslan Stoyanov, who was heading for the international cybersecurity conference in New Denver (Canada). At the conference, the disk was at the disposal of the employee of the American I-Defense company Kimberly Zenz, who, according to the FSB, supposedly collaborates with the FBI. Mikhailov allegedly handed the second copy of the CD for the entrepreneur Georgy Fomchenkov, who flew out with “secret information” in the United States.

For the contents of the CDs of Mikhailov and accomplices, $ 10 million allegedly promised.

True, this figure is no longer in the indictment. She appeared in leaks when it was only investigated. Perhaps the investigators could not at least somehow confirm these data-not to attach to the materials of the criminal case as evidence of the screenshots of the correspondence of one of the former partners of Vrubblevsky, who offered up to 10 million dollars for ruin and prison term by the founder of Chronopay.

If you introduce these letters, you will have to re -qualify the criminal case against Mikhailov from the state treason to attempted bribe. However, in the version that is stated in the indictment, treason is not visible. The maximum is drawn by the story related to the criminal case against Vrubblevsky is the disclosure of information constituting a state secret (materials of operational-search measures before declassified also fall under the definition of GOSTain).

Pavel Vrublevsky refused any comments, referring to the fact that he gave a “non-disclosure subscription” (my interlocutor did not clarify who he was going through a spy criminal case-a witness or a victim).

The only comment that I got from him is the words: "Mikhailov is a traitor and a bastard."

In turn, Mikhailov’s accomplices, who made a deal with the investigation, the FSB major Dmitry Dokuchaev and entrepreneur Georgy Fomchenkov admitted in their testimony in the transfer of CDs with the secret materials of Kimberly Zenz, but insisted: they did not know that the FBI should turn out to be the end addressee. (We talked about the contacts of Dokuchaev and Fomchenkov with Zenz in January 2017.)

Let me remind you of the canvas of history. In January 2017, information appeared that on December 5, 2016, the Moscow Garrison Court issued sanctions for the arrest of FSB officers: Colonel Sergei Mikhailov and Major Dmitry Dokuchaev, as well as the head of the Kaspersky Laboratory Investigation Department, Ruslan Stoyanov and IT businessman Georgy Fomchenkov. Then it became known that the “coherent” between the defendants in the “spy” criminal case and the FBI supposedly was Kimberly Zenz. The same Zenz, who, back in 2007, was one of the first to talk about the “Russian cybermafia” ( details in the “New” of January 27 and 31, 2017 ).

Then, in January 2017, the largest specialist in cybercrime, the author of the KrebsonSecurity.com blog, whose audience exceeds one million readers, Brian Krebs (Brian Krebs) published a hint of material: it was Sergey Mikhailov who passed thousands of confidential Cyberdelad documents in Russia. And it was precisely these documents that supposedly formed the basis of the book by Krebs Spam Nation, which became a bestseller in the United States.

In the same publication, which appeared on his website on January 28, 2017, Krebs released the screenshot of the electronic letter of Pavel Vrublevsky, dated September 2010, in which the founder of Chronopay shared his suspicions that Colonel Mikhailov was working with the FBI.

The correspondence of Vrubblevsky was stolen in 2011. Then she came to Brian Krebs. But Krebs unveiled this letter only on January 28, 2017. Although it is obvious that if Vrubblevsky’s letter was frank misinformation, it would immediately appear in the open space. For example, to discredit the deputy head of the FSB of the FSB Sergey Mikhailov. But instead, the campaign began to discredit Pavel Vrublevsky himself. It was with the submission of Krebs for Vrubblevsky that the reputation of CyberProdnikh No. 1 in the world was fixed, and Sergey Mikhailov initiated a criminal case against Vrubblevsky, which he received 2.5 years in prison, which he served in a colony in the Ryazan region ( details in the New ”of February 2, 2017 ).

Obviously, the “Vrubblevsky case” is not the only episode incriminated by Colonel Mikhailov and his accomplices. But the information about other episodes is extremely scarce. So you can only put forward versions.

One of our sources, familiar with the accusations brought by Mikhailov and his accomplices, hinted that the most serious crime of the former deputy head of the FSB (QIB) center for information security is

The transfer of information to Western intelligence services that allowed the FBI to identify the Fancy Bear group (“Funny Bear”) - as hackers in uniform working under the guise of GRU.

Almost simultaneously with the Americans, they accused of Cybercriminations of hackers in uniform of the Netherlands, Denmark and Great Britain. The British Foreign Ministry, for example, announced the involvement of the GRU in at least 12 hacker groups such as Fancy Bear, Voodoo Bear, Apt28, Sofacy, Pawnstorm, Sednit, Cybercaliphate, Cyber ​​Berkut, Blackevenergy Actors, Strontium, Tsar Team and Sandworm. However, IT sphere experts interviewed by us believe that all these groups are the components of the Fancy Bear hackers team, which lit up in the cyberspace back in 2004.

It is this grouping that is attributed, for example, only in 2015, cyber attacks on the White House and NATO information systems, for German government agencies and the French television channel TV5 Monde. It is Fancy Bear - a key suspect in the hacking of a computer network of the US Democratic Party in the summer of 2016. And hacking the website of the World Anti -Doping Agency in August of the same 2016.

Interestingly, after the arrest of Mikhailov and his accomplices in December 2016, Fancy Bear sharply reduced its activity, practically disappearing from cyberspace. It can be assumed that after a loud arrest, the curators of the hackers received the command "to lie to the bottom."

If this version is not without reason, it is easy to explain the super -secretary of the Mikhailov case. Because

Any leak of information that it was Mikhailov that helped foreign special services to identify Fancy Bear is confirmation that this cybergroup is Russian.

Russia so far denies involvement in the activities of Fancy Bear.