© APA/AFP/SPUTNIK/GAVRIIL GRIGOROV / GAVRIIL GRIGOROV
A Whistleblower sent secret documents to the Süddeutsche Zeitung. These were evaluated jointly by several media, including the Standard was involved. These documents include secret papers and emails from the Russian IT company NTC Vulcan. That’s why the case was also called “Vulcan Files”.
The documents are from the years 2016 bis 2021. They mention a number of programs that hackers describe as being used for cyber attacks. They are called “Amezit”, “Crystal-2V” and “Fraction”. It is not clear from the documents whether these programs were actually used after they were developed.
Cyber attacks on enemy states
However, Vulkan has a total several million euros received for this software. According to the documents, the payments come from institutions linked to Russia’s intelligence services and military. If the Russian state has spent so much on these programs, they probably have been and are still being used.
According to the research of the journalist network, these programs would 4 main purposes assign.
- Bypassing social network security measures to create mass fake profiles
- Redirect and censor Internet traffic in a specific region
- Monitoring and analyzing the social media activity of specific users
- Detection of weaknesses in the infrastructure of enemy states
For the latter point, the documents Mühleberg nuclear power plant in Switzerland as an example, which has now been shut down. That too Swiss Foreign Ministry is given as an example. Both are likely to be placeholders and just examples, not specific targets to be attacked. Furthermore, cyber attacks are mentioned in the documents airports and train lines themed.
Vulcan was founded in 2010
At the company location in Moscow 135 people work for NTC Vulkan. The company was founded in 2010 by 2 men who are said to be close to the Russian secret service FSB. As references, Vulkan cites not only state and military institutions, but also the Moscow Stock Exchange and Sberbank.
Since 2013 Vulkan with the Military Intelligence GRU work together means by a European intelligence agent, according to the standard. The documents appear to confirm the connection. Several indications point to a collaboration with the GRU, specifically with its hacker unit 74455, known internationally as “Sandworm” got known.
