Massive leak links Russian research institute to Kremlin cyber warfare project
Officially, SpetsVuzAvtomatika is a research institute in Rostov-on-Don working on information security and hardware development.
Spetsvuzavtomatika is actually a Kremlin cyber warfare project. By Cybernews.
Follow us
- Leaked documents suggest SpetsVuzAvtomatika supports Russian state-linked hacking and espionage projects.
- DomainTools identified seven projects tied to target scanning, credential theft, Android data collection, and hidden transfers.
- The institute denied a network breach, but researchers say sensitive internal data entered criminal circulation.
- Researchers say the documents do not prove every exposed tool was deployed or used.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Leaked internal documents from SpetzVuzAvtomatika, a major Russian cyber research and development center, show that its projects are essentially a front supporting multiple state-sanctioned hacking operations.
According to DomainTools, a cybersecurity and threat intelligence platform, the SpetsVuzAvtomatika leak found on the darknet exposes a broad Russian cyber research and development program.
An actor began advertising the stolen data – internal technical documents, IP address data, and material taken from the institute’s Git environment – in May.
Even though SpetsVuzAvtomatika denied its internal network had been compromised, DomainTools researchers now say that “authentic and sensitive institute data clearly entered criminal circulation,” and the data is damning.
Cyber espionage developer
According to the threat intelligence platform, the leaked documents show a development environment capable of supporting most stages of cyber-enabled intelligence collection with automation.
“SpetsVuzAvtomatika serves as a government cyber warfare and espionage developer,” said DomainTools.
For example, the documents show direct work with Russian military-unit customers, including Military Units 33949 and 64829. Such work includes Initiative-24, which describes controlling software agents inside corporate networks and extracting information for intelligence purposes.
More specifically, researchers name seven projects that “define” SpetsVuzAvtomatika’s work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing.
Another project, Putnik, supports internal-network access and credential theft. As already mentioned above, Initiative-24 studies the use of trusted cloud services to control software agents and move data from corporate networks.
Has your password leaked?
A scheme named Botany seems focused on modular Android collection while Blik and Glare focuses on concealed storage and offline transfer. Finally, the project Chain-24 focuses on anonymous procurement of hosting and other operational services needed for automated campaigns.
Already sanctioned by the US Treasury
Officially, SpetsVuzAvtomatika is a research institute in Rostov-on-Don working on information security, software, reverse engineering, electronics, testing, and hardware development.
But it’s mostly a front. Already in May 2021, the US Treasury sanctioned SpetsVuzAvtomatika for developing hacking tools for Russia’s foreign intelligence service, SVR.
The leak has provided more information about what the institute actually does. The dump includes technical reports, project requirements, source-code fragments, and attack scenarios, among other internal documents and data, DomainTools said.
Furthermore, the leaked material appears to come from multiple internal systems or a broadly privileged source. However, the documents don’t prove that every exposed tool was deployed or used, researchers pointed out.
The programs found within these documents show a robust platform of Russian cyber espionage capabilities being automated for operations to function more autonomously,said DomainTools.
“Additionally, the programs show a doctrinal approach to using automation that likely will expand in the future with the addition of AI components to augment online espionage and other activities.”
