Spy hunter reveals tricks of the trade
Former FBI operative Eric O'Neill demonstrates on 'Watters' World.'
The names of 305 people tied to the Kremlin’s elite hacking unit were discovered online after investigators followed a paper trail left by a hapless Russian spy.
Aleksei Morenets, one of seven Russian nationals named by the FBI this week in an indictment charging them for their “alleged roles in hacking and related influence and disinformation operations,” was discovered by the investigative news website Bellingcat to be the owner of a car registered to the Moscow address of Military Unit 26165, which the U.S. says is the cyber warfare department of Glavnoe Razvedytalnoe Upravlenie, Russia’s intelligence agency. Morenets was caught trying to break into a computer network belonging to a chemical weapons watchdog in the Netherlands.
The diplomatic passport of Aleksei Morenets, who was expelled from the Netherlands for allegedly trying to hack into a chemical watchdog's network. (AP/Dutch Defense Ministry)
The Dutch released an image of his passport Thursday and Bellingcat reported a listing in a Russian automobile registration database that contained Morenets’ name had the same passport number as seen in the photo.
The website then ran the address in that listing, Komsomolsky Prospekt 20, into the database and uncovered 305 other people with vehicles registered to the same location. Those people, they said, range in age from 27 to 53.
“If these 305 individuals — whose full personal data is available in the automobile registration database consulted by Bellingcat — are indeed officers or otherwise affiliated with the GRU’s Military Unit 26165, their listing in a publicly accessible database may constitute one of the largest mass breaches of personal data of an intelligence service in recent history,” it wrote.
The website reported each of the listings contained passport and phone numbers. But the authenticity of those numbers has not been independently verified. The level of connection that the names in each listing have to the Russian hacking unit -- outside of having the same address – is also unclear.
Morenets is among the four Russians arrested in the Netherlands in April after a bungled operation.
The back of a rental car filled with hacking equipment belonging to four Russians who were arrested in the Netherlands in April. (AP/Dutch Defense Ministry)
The FBI indictment alleged Morenets previously worked in Brazil, where he traveled twice to Rio de Janeiro to try to break into networks used by anti-doping officials – who were investigating Russia -- before and during the 2016 Olympics. According to the indictment, he later went to Lausanne, Switzerland, checking into a hotel near where a senior anti-doping official was staying and helping others break into the complimentary Wi-Fi.
Morenets was busted, though, in April in a Marriott Hotel parking lot in The Hague. He and Alexey Minin, Oleg Sotnikov and Yevgeny Serebryakov -- all said by the FBI to be part of the GRU -- were ambushed and detained by Dutch counterintelligence officers as they tried to break into the Wi-Fi of the Organization for the Prohibition of Chemical Weapons.
The men were expelled from the Netherlands instead of being arrested, because they were traveling on diplomatic passports, according to the Associated Press.
The Dutch yesterday released photos of the men's sequentially numbered diplomatic passports, electronic snooping equipment in the trunk of their car and displays of euros and $100 bills. But among the most damning pieces of evidence was a taxi receipt allegedly seized from Morenets and showing an April 10 trip from GRU headquarters in Moscow to the capital's international airport.
Within hours of Morenets' name becoming public, the Russian news website RBC reached the taxi company listed on the receipt and confirmed its authenticity.
This image released by the Dutch Defense Ministry shows a combo of a taxi bill and a map, with a ride from a street next to the GRU's headquarters to Sheremyetevo airport in Moscow, found in possession of one of four Russians who were expelled from the Netherlands for allegedly trying to hack into the chemical watchdog's network.
Serebryakov, 37, listed by the FBI as one of the GRU's other on-site hacking specialists, appears to enjoy a low key lifestyle combining amateur sports and high-level cryptography.
He played in Russia's Amateur Soccer League between 2011 and 2012, according to the group's website. Serebryakov put "free agent" as his affiliation on the league's website and seems to have kept changing teams, but he always played for those based in northwestern Moscow. That's near the Defense Ministry think tank where he was working at the time and wrote a 16-page research paper on cryptography published in 2014 and still available online.
The Defense Ministry describes the think tank, the Center for Special Research, as being involved with research in "communications security and information systems."
In his research paper, Serebryakov used an email address that referenced a "Casey Ryback," a character played by Steven Seagal in the "Under Siege" action films.
Serebryakov and Morenets also appear to have similar travel documents. Photos from the Dutch Defense Ministry show that Serebryakov's passport is just one digit away from the one held by Morenets.
Minin, a 40-year-old with a short, black beard, was alleged to have rented the team's modest sedan in Holland. Records show he performed courier services for the state-owned firm that administers Russia's state graduation exams. A spreadsheet from June shows Minin delivering exam papers to a high school in southeastern Moscow and lists him as an employee of a state-owned "special communications" department.
The car registration database shows that Minin listed 50 Narodnogo Opolcheniya and Military Unit 22177 as his home address. The four-story beige and yellow building at the address is surrounded by a fence bearing the Defense Ministry's five-pointed star, according to the Associated Press. It's home to the Military Academy of the Defense Ministry, one of Russia's most prestigious schools for military intelligence officers.
The three other men named in the indictment -- Dmitriy Badin, Artem Malyshev and Ivan Yermakov – are wanted by the FBI for many of the same charges that Morenets, Minin, Sotnikov and Serebryakov face, which include: Conspiracy to Commit an Offense Against the United States, Aggravated Identity Theft and Conspiracy to Commit Money Laundering.
The Associated Press contributed to this report.
Fox News' "Antisemitism Exposed" newsletter brings you stories on the rising anti-Jewish prejudice across the U.S. and the world.