UPDATE: Sochi 2014 Cyber Threats Take Shape; Targets Named

Earlier in the week, Analysis Intelligence highlighted the cyber threat posed by Anonymous Caucasus.  As the 2014 Winter Olympic Games drew closer, Anonymous-affiliated Twitter accounts branded the group a “terrorist supporter from Dagestan” and embarked on a separate OpSochi campaign focused on highlighting animal abuses.

Click for an interactive view.

Click for an interactive view.

As identified in the above temporal visualization, on February 6th, specific targets for OpSochi were posted on justpaste.it/OpSochi.  These include olympic.org and sochi2014.com.

Screen Shot 2014-02-07 at 12.40.23 PM

OpSochi v. OpPaybackforSotchi2014/NoSochi2014:  Anonymous Caucasus seeks to highlight Russian atrocities during the Caucasian War (1817-64) in OpPaybackforSotchi2014 while OpSochi (a campaign supported by LegionOps, the European Cyber Army and Anonymous) seeks to highlight animal cruelty (captured orcas for entertainment at the Games) and the killing of stray dogs in Sochi.  On February 4th, LegionOps claimed to have downed over 700 sites as part of OpSochi.

Screen Shot 2014-02-07 at 11.27.48 AM

Who then is Anonymous Caucasus?:  It appears that there are two distinct voices for Anonymous Caucasus, the self-proclaimed “Electronic Army” of the Caucasus Emirate (a Designated Terrorist Organization by both the US and Russia).  This was demonstrated this afternoon, as the @Anony_Caucasus Twitter account sought contact with @AnonCaucasus.

Screen Shot 2014-02-07 at 1.02.46 PM

The Threat:  While an understanding of the rationale behind these attacks can be useful, the targets remain the same: Russian government and Olympic-associated sites.  Of note, Olympic sponsors have been discussed in Open Source as a potential target.

Screen Shot 2014-02-07 at 1.13.09 PM

Additional Reading: Our Sunday Sochi 2014 post provides further information on Anonymous Caucasus and Caucasus Emirate.

Want to develop your own cyber threat intelligence analysis? Check out Recorded Future.

Sochi 2014: The Terror Threat and Russia’s Response

“The most daunting threat (to Sochi 2014) is suicide bombers,” Grigory Shvedov, chief editor of the Caucasian Knot, told The Associated Press.  By Shvedov’s count 124 suicide attackers have struck Russia over the past 13 years.

While LBGT and other activist protests are planned for the 2014 Winter Olympic Games, it is the threat of terrorist activity that looms greatest over the event which begins February 7th.  Further to our baseline of Sochi 2014 threat intelligence, Analysis Intelligence highlights the following on-the-ground sources which regularly feed Recorded Future original information related to the terrorist threat:

Screen Shot 2014-02-05 at 2.49.43 PM

kavkaz-uzel.ru  - the Caucasian Knot, an online news site that covers the Caucasus region in English and Russian.  Established in 2001, it focuses on politics and human rights with a particular focus on freedom of the press.

Screen Shot 2014-02-05 at 2.54.08 PM

blogsochi.ru – Russian language blog which gained notoriety for its mid-January 2014 reporting on a potential suicide bomber within the Sochi city limits.  Of note, according to the Moscow Times, Blogsochi has a contact in the Federal Security Service of the Russian Federation (FSB).    

Outside the Ring of Steel:  Local language sources have been critical to understanding the Russian response, highlighting counterterrorist efforts undertaken in the Republic of Dagestan, a center of operations for the Caucasus Emirate’s Vilayat Dagestan.  Our previous Sochi 2014 entry details the group, which seeks to establish an independent Islamic state in the North Caucasus.  The below Recorded Future visualization highlights the uptick in security operations in Dagestan as Sochi 2014 approaches.  Earlier today, Russian security forces killed Dzhamaldin Mirzayev, a militant who may have helped to train the two suicide bombers who struck the southern city of Volgograd.

Screen Shot 2014-02-05 at 3.13.29 PM

Click for an interactive view.

Inside the Ring of Steel:  Analysis Intelligence continues to monitor claims and perceptions of Russian security.  Interestingly, local source vedomosti.ru has highlighted a fear that the overabundance of security personnel (estimates up to 100,000) in Sochi will leave the rest of the country vulnerable to an attack.

The below visualization tracks the growth in Russian security force estimates which in recent days have risen to 100,000 total security personnel (police, security agents and army troops).  For reference, Sochi security forces (Operational Staff for the Olympics), fall under the jurisdiction of FSB deputy director Oleg Syromolotov.

Screen Shot 2014-02-05 at 3.56.37 PM

Click for an interactive view.

Analysis Intelligence utilizes Recorded Future’s patented Temporal Analytics Engine, mining threat intelligence from the open web.   We will continue to monitor Sochi 2014′s cyber and physical threats as they emerge.  

Sochi 2014: Understanding Physical and Cyber Threats

Former CIA Deputy Director Michael Morell recently called the 2014 Sochi Winter Games “the most dangerous Olympics” of his adult life. Recorded Future analysis highlights the following cyber and physical threat actors and provides “sources to watch” to aid risk assessment.

Monitoring the following sources – familiar to many threat intelligence analysts – can provide continued situational awareness if you or your organization is somehow involved with Sochi 2014.

Sochi Tweet

@AnonsCaucasus / @Anony_Caucasus - Official Twitter handles of Anonymous Caucasus aka the “Electronic Army of the Caucasus Emirate.” Using #OpPayBackForSotchi2014 (note spelling) and #OpSochi.

kavkazcenter.com / @KavkazCenter - Official news portal of the Caucasus Emirate (see below).  Banned in Russia, the site has claimed direct contact with Caucasus Emirate officials.

Caucasus Emirate Timeline

Click here for an interactive view.

Background: Hacking collective Anonymous Caucasus has claimed attacks on the Bank of Russia and anti-terrorism site Kavkazpress.ru. In late Dec/2013, they threatened to attack both Russian government and sponsor websites tied to the Games. Analysis has tied their previous domain ”anonymou.so” to a registration including the name “Vilayat Dagestan.”

Vilayat Dagestan (literally: Province of Dagestan, Russian: Вилайят Дагестан, formerly known as Shariat Jamaat), is a member of the so-called Caucasus Emirate (a.k.a. “IK” or Imirat Kavkaz) an umbrella group for Chechan rebels seeking to establish an independent Islamic state in the North Caucasus. In a January 2014 video, two apparent Vilayat Dagestan suicide bombers claimed responsibility for the December Volgograd bombings which took 34 lives.

Doku Umarov (a.k.a. Dokka Abu Usman), a rumored dead Chechen warlord and leader of the Emirate, has urged followers to strike the Sochi Games, which he denounced as “satanic dances on the bones of our ancestors.”

Doku Umarov

As background, some activist groups argue that Russia’s actions during the Caucasian War (1817-64) should be recognized as genocide. Krasnaya Polyana, about 30 miles from Sochi, was the site of the war’s final bloody battle. On February 6, snowboarding events begin at Krasnaya Polyana.

The US State Department in May 2011 designated the Caucasus Emirate as a Specially Designated Terrorist group under Executive Order 13224 and authorized a $5 million reward for information leading to Umarov’s arrest.

Continuing Analysis: Our baseline analysis of Sochi 2014 open source threat information yielded nearly 22,000 references across seven languages.

Screen Shot 2014-02-02 at 12.56.22 PM

With wide ranging estimates of 40,000 – 100,000 personnel, Russia’s military might will provide a significant check on physical threats from the Caucasus Emirate and/or smaller groups. As the Games approach, Analysis Intelligence will provide further information on the Russian response to both the physical and cyber threat.

Interesting in using these threat intelligence analysis? Check out Recorded Future Cyber

IED Trends: Turning Tennis Balls Into Bombs

Terrorists are relentlessly evolving tactics and techniques for IEDs (Improvised Explosive Devices), and analyzing reporting on IEDs can provide insight complementary to HUMINT on emerging militant methods. Preparing for an upcoming webcast with our friends at Terrogence, we found incidents using sports balls, particularly tennis balls and cricket balls, more frequently appearing as a delivery vehicle for explosives. (continue reading…)

How Inspire Magazine Uniquely Motivates Acts of Terrorism

Note: Massive thanks to Dr. Jarret Brachman for his guidance and support in putting together this post. He’s one of the best out there studying violent extremism, and we recommend that you check out his book ”Global Jihadism: Theory and Practice“ and follow him on Twitter.

The Boston bombing investigation continues to reveal new information on the two primary suspects, but quietly reported last Friday was the discovery of jihadi propaganda Inspire Magazine - produced by al-Qaeda in the Arabian Peninsula (AQAP) - on a computer belonging to the elder Tsarnaev brother’s widow. The publication, particularly its first issue containing instructions for building a pressure cooker bomb, was spotlighted as a possible resource immediately after the bombings.

The news the Tsarnaevs possessed Inspire, whether it directly influenced their actions or not, serves as evidence of the AQAP magazine’s reach and visibility in the jihadist community. (continue reading…)

Pattern of Life: The Tsarnaev Brothers

The world learns more by the hour about the Tsarnaev Brothers, Dzhokhar (19) and Tamerlan (26 when killed on Friday), allegedly responsible for the Boston Marathon bombings last week. Their lives in the United States, travel activities since arriving in the country, and reputation amongst peers and family are slowly becoming clear, and every new detail provides a small bit of additional color to those believed to be behind the bombings that left three dead and more than 180 injured.

Here’s a Recorded Future timeline of their life events up to December 2012 that will continue to fill as additional information on each brother becomes available on the open web:

Tsarnaev Brothers Timeline

Click for live view

The above timeline gives us an overview of the quickly filling in life story for each of the brothers. We’re also interested in the answers to several more specific questions that can be derived from the burst of reporting on the brothers:


Map of Tsarnaev Brothers Travel

Click for live view

Quotations about the Tsarnaev brothers

Statements about the Tsarnaevs

Click for live view

Doku Umarov Connections

Examining a strand highlighted by our friend The Jester there are suggestions of a possible connection to between Tamerlan and Chechen militant leader and al-Qaida affiliate Doku Umarov.

Doku Umarov Tamerian Tsarnaev Connections

Click for live view

These storylines and connections will fill out as we learn more from the younger brother Dzhokhar’s testimony. If you want to further examine or build off of these views, check out the Recorded Future report on the Tsarnaev brothers here.

Copyright © 1996-2010 Analysis Intelligence. All rights reserved.
iDream theme by Templates Next | Powered by WordPress