Hacker News Reader

Comment by graeme | Hacker News Reader

It's Microsoft saying it, so presumably they may have some actual technical reasons to believe it's Russians, no?

Like I say at the top, I am not talking about this occurence specifically, but in general when this kind of hacking is mentioned. It is always and only Russians. Like no one else might have an interest.

I am honestly wondering if this is the case.

Also it would be theoretically possible (and easy?) for someone from outside Russia to e.g. hire some Russian hackers, would it not?

I disagree with your statement. I would say that given current events and the coverage of them you are seeing Russia more that other entities.

This happens for a variety of reasons, some technical, some political. The technical ones are when indicators for an active APT group are released it becomes easier for others in the industry to see them and to catch them or report on their activity. This results in that group having more attention in the media as firms publish their findings.

The prior US administration took the step of sharing many of those indicators with the industry and so the Russians are getting caught more often.

This has happened before. Remember the 'Aurora' incident that Google had around 2010? That time frame from 2006-2014 the Chinese were dominating the news for this sort of espionage.

In short, I think that we are simply catching the Russians more often right now as they haven't had time to retool or cover their tracks and there are active defensive campaigns targeting their teams. Obviously other countries have an interest (including the US - remember the Vault7 leaks?). As an example, there was an article on HN just recently about how the Chinese rolled up the CIA network in their country via a compromise of the CIA's messaging system.

As far as hiring Russians, the specific groups that firms like Microsoft track are ones composed of government entities (hence the article notes 'Hackers linked to Russian government entities..'). They are not generally hirable by third parties.

I don't think it is, but luckily we don't have to take anyone's word or intuition. It should be easy enough to set up a test to see for yourself:

https://duckduckgo.com/?q=-russian+hackers&t=hg&iar=news&ia=... https://www.google.com/search?q=hackers+-russian&source=lnms...

Lots of stories about generic hackers, Chinese hackers, North Korean hackers, etc. within the past 24 hours. You can even take this a step further and search "<country denonym> hackers -russian" and see what comes up. Apparently some Canadian hackers recently came into a windfall of bitcoin.

Reply on news.ycombinator.com