"Oil into the Fire:" An Inside Look at SVR Cyberespionage

"Oil into the Fire:" An Inside Look at SVR Cyberespionage

Speakers: Michael van Landingham (Former CIA Analyst, Active Measures LLC); Alex Orleans

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=EEqYXXGjofU

Overview

In "Oil into the Fire," Michael van Landingham and Alex Orleans presented a deeply analytical and revelatory examination of Russian Foreign Intelligence Service (SVR) cyberespionage operations targeting the 2016 US presidential election. Drawing on recently declassified US government documents, the speakers unveiled a startling discovery: a significant portion of the SVR-attributed intelligence collected by the US government during this period was not authentic but rather fabricated or "forged" by the SVR itself. This talk, delivered at CYBERWARCON, challenges conventional understandings of Russian intelligence tradecraft and inter-service dynamics, offering critical insights into the complex motivations behind state-sponsored cyber deception.

The presentation meticulously dissects the evidence supporting these forgeries, highlighting thematic, linguistic, and editorial inconsistencies within the purported SVR intelligence. Van Landingham, a former CIA Russia analyst, and Orleans, a seasoned CTI expert, argue that these fabrications were driven by a combination of internal Kremlin politics—specifically, the SVR's efforts to "suck up" to leadership and denigrate rivals like the GRU—and sophisticated offensive counterintelligence objectives. The implications of these findings are profound, urging network defenders and intelligence analysts to adopt a more nuanced perspective on adversary capabilities and motivations, moving beyond the simplistic view of a monolithic foreign state actor.

The talk not only provides a historical deep dive into the 2016 election interference but also offers practical applications for contemporary cyber defense. By exposing the SVR's deceptive tactics, the speakers underscore the importance of rigorous authentication in intelligence analysis and advocate for a strategic understanding of adversary internal dynamics. This detailed exposé serves as a crucial reminder that the information landscape, particularly in the realm of state-sponsored cyber operations, is often intentionally muddied, requiring constant vigilance and critical assessment to discern truth from sophisticated deception.

Background

▶ Watch: Introduction and speaker backgrounds (0:00)

To comprehend the SVR's actions in 2016, it's essential to understand the complex and often fractious landscape of Russian intelligence. The SVR, as the foreign intelligence service of the Russian Federation, is a direct descendant of the KGB's First Chief Directorate. Its core missions include foreign intelligence collection, offensive counterintelligence abroad (a unique specialization), and covert influence operations, commonly known as active measures. Historically, the SVR has prided itself on sophisticated human intelligence (HUMINT) operations, viewing itself as the more refined element within Russia's intelligence community. However, compared to the military intelligence service (GRU) and the domestic security service (FSB), the SVR possesses significantly fewer cyber assets and resources, a historical legacy that placed it at a disadvantage.

By 2014, the SVR found itself in a precarious position within the Kremlin. A series of setbacks, including the 2010 Operation Ghost Stories (where several SVR illegal undercover officers were arrested by the FBI), and its perceived failures during the 2014 Ukraine crisis, led to a loss of influence with President Vladimir Putin. This diminished status created an urgent need for "big wins" to regain favor. With HUMINT being a slow process, cyber operations emerged as a perceived quick path to demonstrate value. This period, starting around 2014, coincided with the significant ramping up of operations by what the US government would later attribute to the SVR, known in the private sector as Cozy Bear, APT29, or Midnight Blizzard. These intrusion sets gained a reputation for stealth and persistence, engaging in what one US government official described as "hand-to-hand combat" to resist remediation, targeting high-value political and diplomatic entities such as the White House, Pentagon, State Department, and the Democratic National Committee (DNC).

The DNC breach became a focal point of the 2016 election interference narrative. The SVR gained access to the DNC network in mid-2015 and maintained a persistent presence. However, in March-April 2016, the GRU (known as APT28, Fancy Bear, or GRU26165), employing a much noisier spear-phishing campaign, also gained access. The DNC’s engagement of CrowdStrike for remediation led to the discovery of both SVR and GRU presence, sometimes even stealing the same passwords. Following the public revelation of these intrusions in June 2016, the GRU rapidly established personas like Guccifer 2.0 and DC Leaks to disseminate stolen information, also passing material to WikiLeaks, which began publishing in late July and October. This sequence of events, as the speakers humorously put it, saw the GRU "kick down the door, shouts Leroy Jenkins," overshadowing the SVR's more subtle, long-term operations. Crucially, behind the scenes, clandestine reporting indicated that Putin decided to leak DNC emails after believing Hillary Clinton would win.

A critical, lesser-known element of this background is the compromise of the SVR's own cyber operations backend network. According to Dutch and American press reports, Dutch intelligence (AIVD) had compromised this network as early as 2014, maintaining access through at least 2015—the period during which the SVR compromised the DNC. Parallel to this, recently declassified documents reveal that a foreign source, dubbed T1, collected on SVR cyber operations networks and passed this intelligence to the US government. While the direct link is unconfirmed, the strong implication is that the AIVD provided this access or intelligence, suggesting the SVR was likely aware, at some point, of its own compromise. This awareness forms a crucial foundation for understanding the SVR's subsequent deceptive actions.

Key Findings

▶ Watch: Dutch intelligence compromised SVR's cyber operations backend (9:00)

The central and most significant finding presented in this talk is the revelation that a substantial body of SVR cyber espionage material, collected by the US government in 2016 through the foreign source T1, was forged. This material, purporting to be authentic SVR intelligence derived from communications among senior Democratic political actors, White House officials, and think tank personnel, contained politically charged narratives, such as claims of the White House pressuring the FBI to exonerate Hillary Clinton or salacious reports about her health. However, unlike the GRU's leaked documents, this SVR material was never leaked publicly and was notably absent from the public version of the 2017 Intelligence Community Assessment (ICA).

The authenticity of these documents was definitively debunked by investigations conducted by the Department of Justice Inspector General (DOJ IG) and the Durham investigation, both recently declassified. These law enforcement inquiries involved interviewing the alleged victims whose communications were purportedly intercepted. Universally, these individuals denied having the conversations described, not knowing the other parties, or in some cases, the meetings themselves never occurred. Furthermore, when presented with the verbatim material, purported authors denied having written it.

Beyond victim testimony, the SVR emails and memoranda exhibited clear signs of manipulation, categorized into three key areas:

1. Thematic Inconsistencies: The documents contained themes highly relevant to Russian leadership but incongruous for an American author. For instance, multiple emails referenced the Olympics as a benchmark for scandal. This theme strongly resonated with Vladimir Putin, who, at the time of the purported email writings, was meeting with Russian Olympic athletes and discussing accusations of doping from the World Anti-Doping Agency (WADA). Six weeks later, GRU's APT28 hacked WADA, further underscoring the Russian state's focus on the issue. Another thematic element was the SVR's overt disdain for the GRU, criticizing their sloppy tradecraft and "clown hours" in the context of Guccifer 2.0's attribution. This analysis, disguised within American-authored texts, served to smuggle SVR's internal critiques to their leadership without appearing disloyal.

1. Linguistic Anomalies: The English language used in the forged documents displayed clear characteristics of non-native speakers. A striking example was the phrase "oil into the fire," which an American author interviewed by the Durham investigation explicitly stated they would never use, preferring "fuel to the fire." "Masco" is the Russian idiom for "oil into the fire," indicating a direct translation. Other awkward phrasings included "Americans are more keen on their woes," "Hillary is hardly good-looking," "A critical infrastructure threat for the election to feel menace," and "appear hardly skilled." These constructions are highly uncharacteristic of native English speakers but common for those who learned English after speaking Russian.

1. Editorial Issues: Direct evidence of an editorial hand was present. One English-language email existed in two versions, with one adding the aforementioned reference to the Olympics, clearly tailored for Russian leadership consumption. More damningly, language from a genuine email from a US think tank expert, discussing Thomas Rid's article in Vice and another Bloomberg article on South American election rigging, was found cut-and-pasted into a new email attributed to a different author at another think tank, discussing an entirely separate topic. This copied text also contained added misspellings and mistakes, a highly improbable scenario for legitimate intelligence collection. These editorial manipulations strongly suggest the SVR was not simply translating collected intelligence but actively constructing and altering documents.

These findings collectively lead to the conclusion that the SVR was actively engaged in a sophisticated deception operation, crafting fabricated intelligence to serve specific internal and external objectives, rather than merely reporting legitimate collection.

Technical Deep Dive

▶ Watch: Shocking revelation: All SVR's collected documents were fake (12:00)

The "technical" aspect of the SVR's operations, as revealed by the analysis of these forgeries, lies not in novel exploits or malware but in the sophisticated tradecraft of information manipulation and deception. The SVR, often described as a stealthy and persistent actor (e.g., Cozy Bear/APT29), demonstrated a capacity for deep network penetration that allowed them to be present in target environments like the DNC for extended periods. However, when it came to the intelligence they reported, a different kind of technical skill—that of crafting convincing but ultimately fabricated narratives—came to the fore.

The SVR's modus operandi, particularly when compared to the GRU, was traditionally one of quiet infiltration and long-term presence. They were known for resisting remediation efforts, engaging in "hand-to-hand combat" to maintain access. This contrasts sharply with the GRU's noisy, smash-and-grab approach, as exemplified by the Guccifer 2.0 leaks. The forgeries themselves leveraged this contrast and the internal dynamics of the Russian intelligence community. By embedding criticisms of GRU's "sloppy tradecraft" within purported American communications, the SVR was effectively using a stolen platform to convey its own analysis and denigrate a competitor to their shared customer, the Kremlin. This highlights an advanced understanding of the target audience (Putin) and the internal political landscape.

The specific instances of thematic, linguistic, and editorial manipulation provide a blueprint for identifying sophisticated state-sponsored deception:

• Thematic Tailoring: The inclusion of the Olympics narrative is a prime example of tailoring intelligence to the known interests and biases of the primary consumer, Vladimir Putin. This demonstrates an understanding of the Kremlin's "confirmation bias" and the desire for intelligence that validates existing viewpoints. The SVR was not merely reporting facts but curating a narrative that would resonate deeply with its leadership, even if it meant fabricating details. The subsequent WADA hack by GRU further contextualizes the Russian state's intense focus on the Olympics during this period.
• Linguistic Fingerprints: The "oil into the fire" idiom is a classic example of calque or loan translation, where a phrase is translated word-for-word from one language to another, resulting in an unnatural or incorrect expression in the target language. This is a common linguistic tell for non-native speakers and a critical indicator of fabrication when presented as originating from a native speaker. The other awkward grammatical constructions reinforce this, suggesting that while the SVR had English-speaking capabilities, they were not sufficient to flawlessly replicate native English prose, especially under pressure.
• Editorial Assembly: The cut-and-paste technique, where real text from one document is inserted into a fabricated document attributed to a different author on a different topic, is a crude yet effective method of creating seemingly authentic content without having to invent everything from scratch. The addition of misspellings could be an attempt to mask the copy-paste operation, make the document appear less polished (and thus more "real" or hastily written), or simply a result of the fabrication process itself. This method is particularly insidious because it leverages genuine source material to lend credibility to fabricated narratives.

The motivations behind these forgeries are posited as two primary, non-mutually exclusive theories:

1. Sucking Up (Kremlin Politics): The SVR, facing diminished status and competing for influence and budget with the GRU and FSB, needed to deliver intelligence that would please Putin and validate his existing views. Fabricating intelligence that aligns with leadership's confirmation bias ("mirror imaging") and simultaneously denigrates rivals (like criticizing the GRU's "sloppy tradecraft") serves this purpose. It's a modern evolution of long-standing inter-service rivalries, where agencies would even report the same open-source data to see who could get it to the Kremlin faster. The SVR's comparative lack of data processing resources may also have pushed them towards crafting concise, impactful, and politically tailored "analytic products" rather than sifting through vast amounts of raw data.

1. Counterintelligence: The SVR was likely aware of its compromise by AIVD and the subsequent collection by T1. This awareness could have prompted them to "poison the well" by feeding fabricated intelligence to the compromised channel. The objectives could include:

• Tactical Deception: Distracting from other avenues of compromise or protecting a human source.
• Complicating Analysis: Introducing noise and false leads to overwhelm and confuse adversary intelligence analysts.
• Influencing Public Opinion: Hoping the fabricated documents would leak to the Western public, inciting opinion against targets or muddying the waters.
• US Leadership Influence: Most critically, influencing the decision-making processes of US government officials. The talk highlighted former FBI Director Jim Comey's acknowledgment that the SVR's sensational claims about White House pressure on the DOJ (even if he had doubts about their authenticity) factored into his "unusual decision" to hold a press conference regarding Hillary Clinton's email server, labeling her conduct "extremely careless." This demonstrates the real-world impact of successful information fabrication on high-level government actions.

In essence, the SVR's "technical deep dive" in this context is a masterclass in psychological operations and information warfare, demonstrating how sophisticated intelligence agencies can weaponize information itself, even without deploying advanced cyber exploits, to achieve strategic objectives.

Demo / Proof of Concept

▶ Watch: Forged SVR intelligence influenced FBI Director Jim Comey (23:00)

The talk "Oil into the Fire" did not feature a live demonstration or proof of concept in the traditional sense of showcasing a technical exploit or tool. Instead, the "proof" lay in the meticulous presentation and analysis of declassified documents, linguistic inconsistencies, and thematic correlations, which served as compelling evidence for the SVR's fabrication of intelligence. The speakers effectively demonstrated the impact of these forgeries through the detailed breakdown of the Comey example and the broader implications for intelligence analysis.

Defensive Implications

▶ Watch: Key takeaway: Adversaries are not monoliths; look for internal dynamics (24:00)

The revelations presented in "Oil into the Fire" carry significant defensive implications for cybersecurity professionals, intelligence analysts, and policymakers. The primary takeaway is the critical need to view foreign state adversaries not as monolithic entities but as complex organizations influenced by internal politics, competing agendas, and individual motivations.

1. Deconstruct the Adversary: Network defenders and intelligence analysts must move beyond simplistic "black box" views of threat actors. Understanding the internal rivalries (e.g., SVR vs. GRU), resource limitations, and pressures facing individual operators and their leadership can provide crucial context. Knowing that an SVR operator might be "just trying to hold on tight and get through the day" under pressure to please bosses can inform how their operations are conducted and how data might be manipulated or presented. This granular understanding can unlock opportunities for counter-exploitation.

1. Rigor in Intelligence Authentication: The most profound implication for analysts is the imperative to prioritize confirming the authenticity of intelligence, rather than excusing problems or assuming systemic but legitimate issues. The speakers noted that in 2016, problematic SVR collect was often regarded as having "systemic" issues but not implicating the entire batch as forged. This historical oversight underscores the need for a default posture of skepticism and rigorous verification, especially when intelligence aligns too perfectly with existing biases or appears sensational. Analysts must actively look for linguistic tells, thematic tailoring, and editorial inconsistencies as potential red flags for fabrication.

1. Strategic Remediation and Anticipation: Understanding that an adversary might engage in poisoning the well or tactical deception can guide remediation efforts. If an organization suspects a compromise, considering that leaked data or intelligence might be deliberately manipulated can change the perception of "dual access" or "dual use access" into networks. It can help anticipate how a potential data leak might be exploited by an adversary, not just for direct espionage but for influence operations or to muddy the waters.

1. Influence Operations and Decision-Making: The case of former FBI Director Jim Comey highlights the tangible impact of fabricated intelligence on high-level decision-making. Defenders must recognize that even if intelligence is partially or wholly forged, its mere existence and the perception of its credibility can sway critical judgments. This necessitates not only technical defenses but also robust processes for vetting and contextualizing intelligence at all levels of an organization, particularly in sensitive political or national security contexts.

1. Beyond Technical Indicators: While technical indicators of compromise (IOCs) remain vital, this talk emphasizes the importance of human and political intelligence in understanding the full scope of cyber threats. The SVR's forgeries were not about zero-day exploits but about manipulating information to achieve strategic objectives related to influence and internal power dynamics. This expands the scope of "defensive intelligence" to include geopolitical context, organizational psychology, and linguistic analysis.

In essence, the talk advocates for a more holistic, critical, and context-aware approach to cybersecurity and intelligence. By exposing the SVR's capacity for sophisticated deception, it challenges defenders to look beyond the immediate technical artifact and consider the broader strategic game being played.

Key Takeaways

• SVR Forged Intelligence: A significant portion of the SVR cyber espionage material collected by the US government in 2016 was fabricated, not authentic intelligence.
• Motivations: Suck Up & Counterintelligence: The forgeries were driven by a dual purpose: pleasing Kremlin leadership (affirming biases, denigrating rivals like GRU) and offensive counterintelligence (poisoning compromised channels, complicating analysis, influencing US opinion/leadership).
• Evidence of Forgery: Forgeries were identified through victim interviews (denials of conversations/authorship) and internal document analysis revealing thematic inconsistencies (e.g., Olympics references), linguistic anomalies (e.g., "oil into the fire"), and editorial manipulations (e.g., cut-and-paste text, added misspellings).
• Adversaries Are Not Monolithic: Foreign state intelligence services are complex organizations with internal rivalries and individual agendas, which significantly influence their operations and reporting.
• Analytical Rigor is Paramount: Analysts must adopt a skeptical posture, prioritizing authentication of intelligence and avoiding the excuse of "systemic issues" for problematic documents, especially when dealing with potentially compromised sources.
• Real-World Impact: Fabricated intelligence can have profound real-world consequences, as demonstrated by its potential influence on high-level US government decisions, such as former FBI Director Jim Comey's public statements on Hillary Clinton's emails.

About the Speaker(s)

Michael van Landingham is a former CIA analyst with a specialized background in Russian intelligence services and foreign policy. During his tenure at the CIA, he served as a Russia analyst for several years. In 2016, he was a key member of the fusion cell, a joint NSA, CIA, and FBI effort specifically tasked with examining Russian information operations targeting the US presidential election. He also served as one of the co-lead authors for the 2017 Intelligence Community Assessment (ICA) assessing Russian interference in the 2016 election. Currently, he is affiliated with Active Measures LLC.

Alex Orleans brings a decade of experience in Cyber Threat Intelligence (CTI) to the stage. He began his career at FireEye, working under John, before moving to CrowdStrike, where he oversaw all of their state nexus tracking for several years. His area of expertise is counterintelligence, and he has been published in the CIA's internal journal, Studies in Intelligence, on a Russian counterintelligence case. His deep understanding of adversary tradecraft and intelligence dynamics informs his analysis of state-sponsored cyber operations.