Russian hacker 'militia' mobilizes to attack Georgia

Volunteers, botnet owners join forces to knock sites offline, say researchers

Security researchers Tuesday disputed claims that a well-known Russian hacker hosting network is responsible for cyberattacks against sites belonging to Georgia, the former Soviet republic that has been battling Russian military forces since Friday.

Rather than blame the notorious Russian Business Network (RBN) -- as researcher Jart Armin did over the weekend -- other researchers said Tuesday that it appears the attacks originated from a "hacker militia" of Russian botnet herders and volunteers.

"They mobilize themselves without a need for a central location to do so, distribute the targets, discuss the attack approaches, come up with a plan on the coordination, and you have everyone participating," Bulgarian security researcher Dancho Danchev said in an instant messaging interview early Tuesday.

Danchev and others have found evidence that points to a self-starting militia composed of volunteer hackers and cyber criminals who control large-scale bots, or collections of previously-compromised computers, as behind the escalating attacks that have knocked Georgian sites offline.

"A lot of it started with posting on blogs," said Kimberly Zenz, a senior threat analyst with VeriSign's iDefense. "A bunch of youth groups posted something that was almost a manifesto that called on supporter to 'wage an information war' against Georgia."

That call to arms was only one of many, said Zenz and Danchev, both whom noted similarities to the attacks against several hundred Lithuanian Web sites early last month.

But while the forces assembled only appear to be uncoordinated to the untrained eye, they are in fact very coordinated, both researchers argued. In a lengthy blog post, Danchev spelled out the coordinated steps that someone -- or some group -- took to rally the hacker troops and turn them against specific targets.

"In the ongoing Russian versus Georgia cyberwar, we have an indication of lists [of Georgian governmental sites] actively distributed across Russian web forums," said Danchev in the blog entry. He also said there were signs that hackers had been provided simple distributed-denial-of-service (DDoS) tools, and that lists of Georgian sites vulnerable to SQL injection attacks had been circulating.

"Someone is coordinating activities," said Zenz, "by posting on blogs and forums instructions that essentially say 'This is what we're going to do.' But we don't know who's behind that."

That coordination, said Danchev, was sophisticated enough to launch DDoS attacks against one of the most popular hacker forums in Georgia as a preemptive strike. But the attacks weren't entirely successful, since limited retaliations against Russian sites have succeeded. "Georgian hackers, or pro-Georgian hackers, [launched] distributed-denial-of-service [attacks against] RIA Novosti," he said via IM. RIA Novosti is a Moscow-based news service.

The campaign against Georgia is just a sample of what the world should expect when there's armed conflict, said Zenz. "This is what happens," she said, "especially in Russia. Every time something happens, there are attacks. Name any crisis there in the past year, and I can point to a spike in attack traffic."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?