Roshka and mouse. The post of President of France was hackled by GRU employees

On Thursday, the France Government Office said that it did not reveal any “Russian trace” in Kiberatak on Emmanuel Macron. Vladimir Putin performed a little more vaguely, saying on the eve that if it was Russian hackers, then certainly not related to the state. However, how it was possible to find out The Insider, the hackers of Macron had the most directly related to the state - they were current employees of the Main Intelligence Directorate of the Russian Armed Forces.

In early May, The Insider already wrote that the name of Georgy Petrovich Roshki was discovered in metadata broken letters of French President Emmanuel Macron. Then The Insider was not known about him yet: for example, he visited the Pavt-2014 information technology conference as an employee of Eureka CJSC, and that Eureka tightly cooperates with the Ministry of Defense. It was also possible to find out that, together with Roshka, to the conference (also on behalf of Euryk) was traveled by Sergey Zaitsev, who operates at the Center for Special Development of the Ministry of Defense of the Russian Federation, and that this center is gaining employees who are professionally familiar with programming and cryptography. The Insider officially replied to Eurica that Roshka had never worked in the company and no one went to the Pavt-2014 conference on her behalf. The Eureck also reported that “in open sources” you can find information that Roshka in 2016 and 2017 also participated in the PAVT conference, but “in a different status”. In what status, and what kind of open sources these were, in Eureka, could not explain (the search on the Internet did not allow to find any traces of Roshka’s participation in later conferences, and indeed no other references). The Insider tried to get this information from the organizers of the conference - and here the oddities began.

Special Purpose Conference

One of the key organizers of the conference, co -chairman of the PAVT program committee, Leonid Sokolinsky (head of the SURD System Programming of SURGU), informed The Insider that he could not provide data about the conference participants in 2016 and 2017, since the “Database failure, as a result of which the discs were out of construction and information was not preserved”. According to him, the failure occurred due to the fact that the storage system was old. He also noted that “any person from the street” can sign up for the conference and where he is not checked in any way.

Well, it looks like The Insider was just unlucky. But just in case, the publication turned to another co -organizer of the conference - Vladimir Voevodin, the head of the supercomputers and quantum computer science of Moscow State University, and he unexpectedly presented a completely different answer: he has a list of participants, but he cannot give it because of the decision not to disclose personal data. When asked why in 2014 this list was openly posted on the site, Voevodin replied that "they began to treat personal data more seriously."

Regarding the registration procedure, Voevodin replied that those who wish to submit an application, then “the work is examined, a review is written, the most powerful are selected. If accepted, it means a person acts. ” At the same time, according to him, no one checks from which organization a participant: “The request to the organization is not written that, they say, the institute such and such a work signed such and such a person. The organizers watch only the scientific component of the work and its compliance with the topic of the conference. ”

Everything would be fine, but Roshka had no report at the conference, and indeed the number of speakers at the conference was noticeably lower than the number of participants. Yes, and it did not seem that people from the street were allowed to the event. In particular, military personnel were included in the list of participants. For example, Ivan Kirin, Andrey Kuznetsov and Oleg Skvortsov registered from the military unit No. 71330. Judging by the information in open sources, this military part specializes in electronic intelligence, radio interception and decryption. And Alexander Pechkurov and Kirill Fedotov registered from the military unit No. 51952 radio interception of the 16th Center of the FSB of Russia. In addition, three employees of the FSUE “Quantum”, a subordinate FSB, which back in 2015 were convicted of relations with hackers, participated in the conference.

How did it turn out that special services employees are openly registered under their proper names? Vladimir Voevodin told The Insider that "the participants themselves care about secrecy, all responsibility lies with them."

But the main question was not able to get an answer - who is Roshka and in what status he appeared at subsequent conferences? To find out, The Insider sent letters to all participants in the 2014 PAVT conference with a request to send the composition of the participants for 2016 and 2017. And one of the addressees sent both documents.

In 2016, opposite the name of George Roshki, the “military unit No. 26165, a specialist” was listed.

The 85th Main Center of the Special GRU Service, it is the military unit No. 26165, specializes in cryptography.

GRU hackers

After the mysterious death of the head of the GRU Igor Sergun, the former head of the GRU of the 85th GRU Special GRU Service, after the mysterious death of the GRU, was read in his place, but he became only the deputy of the new head - Igor Korobov. Both Gizunov and Korobov today are under American sanctions in connection with the “actions to undermine democracy in the United States” - that is, in connection with hacker attacks. But if Korobov came under sanctions simply as the head of the GRU, then Gizunov could have the most direct relationship to cyber attacks - he is a cryptography specialist who has a number of scientific works on this subject. The 85th Main Center for the Special Service, located in Moscow at Komsomolsky Prospekt, was engaged in the same theme of the same theme. It was this historical building (former Khamovnicsk barracks built under Alexander I), apparently, went to the service of Georgy Roshka.

Sergey Zaitsev, who also traveled to Pavt-2014 on behalf of Euryk, and then lit up as an employee of the Center for Special Development of the Ministry of Defense of the Russian Federation, does not appear on the list of participants in 2016 and 2017. But here's what is curious: if in 2016, Roshka is registered from the military unit, then in 2017 it appears as a “researcher at the Center for Strategic Development”. Most likely, this refers to the same center of special developments of the Ministry of Defense (it is difficult to imagine that Roshka suddenly got a job for curls). But it cannot be ruled out that this position was just a cover: it was simply necessary to add something to the questionnaire. But why did Roshka in 2014 seemed to be an employee of the Eureka company - this was also a cover? Or does he still have some kind of attitude towards her?

Eureka and Hacker Factory

In "Eurica" ​​categorically denies any connection with Roshka:

“The present we inform that Roshka Georgy Petrovich in the period from 01.01.2003 to 05/10/2017 in CJSC Eureka, TIN 7827008143 did not work on a permanent basis and did not conclude a civilian contract. Roshka Georgy Petrovich was also not found in the lists of students of the training center, as well as in the database of electronic addresses of the domain .Eureca.ru. ”

It is not possible to verify the veracity of this answer. But it is precisely the training center of Euryk that is of particular interest. Formally, he conducts "Courses on Information Technologies". But the sources of The Insider (who asked for anonymity), well -known with the company, said that the very “training center” of Euryk, among other things, is engaged in the preparation of future hackers among special services.

The Ministry of Defense of Russia does not deny the presence of Cybervsk, but where exactly are the training factories of hackers, of course, is not reported. Perhaps, Moskovsky Prospekt, 118 is one of these places.

It is curious that, as it was possible to find out the project “The Municipal Scanner”, one of the three co-owners of Euryk Alexander Kinal in February this year purchased an apartment in an elite house on the Stone Island of St. Petersburg at the address 2nd Birch Alley, d 19. Insider already wrote about this legendary house, in which Vladimir Putin’s closest encirclement, including his friend, lives. According to Judo, Arkady Rotenberg, former presidential administration Vladimir Kozhin, some members of the Lake Cooperative ( Nikolai Shamalov, Yuri Kovalchuk, Sergey Fursenko and Viktor Myachin) and ex-head of the Malyshevsky criminal group Gennady Petrov . It was Petrov’s apartment with an area of ​​478.7 sq.m (approximate value of about $ 9 million) according to the “municipal scanner” and bought by the co -owner of Euryk.

Stage of denial

It is curious that Vladimir Putin denies the connection of hackers with Russia is no longer so categorical , they say - they can be just Russian patriots that act regardless of the state:

"The background of interstate relations also matters in this case, because hackers are free people as artists: their mood is good, they got up in the morning and engage in the fact that the paintings are drawn. The same hackers. They woke up today, read that something is happening in interstate relationships; if they are patriotic, they begin to contribute, as they believe, the right, correct, in the struggle with the struggle with the struggle with the struggle with the struggle. Those who speak poorly?

The story about "free artists" did not appear by chance. Dozens of organizations in the field of cybersecurity from different countries that studied the activities of groups known as Fancy Bear and Cozy Bear have collected enough data that indicates that representatives of these two groups act from large cities of Russia, speak Russian, work in Russian working time (resting in Russia) and attacks the weekends that may interest those that may be interested in The Russian government is both abroad (Hillary Clinton, Emmanuel Macron, a number of European politicians and journalists, NATO military facilities, goals in Ukraine and Georgia, etc.), and within the country (opposition, journalists, NGO employees). It is already impossible to deny the connection of hackers from these two groups with Russia today. But you can try to present them as independent entities. About the same as independent actors represented "militias of Novorossia."

Previously, this excuse was refuted only by indirect evidence (for example, the fact that Fancy Bear and Cozy Bear, according to experts, demanded that they constantly work well -trained employees and serious financial resources - “free artists” are not possible). Now the participation of the GRU is confirmed by direct evidence. Putin’s attempts to explain everything by the fact that “someone inserted a flash drive with the name of some Russian citizen” will also hardly convince anyone: the name of Roshka had never surfaced either in connection with the hackers or in connection with the GRU (and, perhaps, if this would not be the investigation), so it could not be used for provocation.

About where the “factories of hackers” could still be located and who oversee their work from the Kremlin - read in the next investigations The Insider.

The material was prepared with the participation:

Anastasia Kirilenko, Sergey Kanev, willow Tsoi, Anna Begiashvili