Why So Many Hackers Are Russian

Summary

This video script delves into the world of Russian hackers, portraying three fictional characters to illustrate different facets of cybercrime. Leonid, a young hacktivist, sees hacking as a way to strike back at perceived enemies of Russia. Peter, a ransomware operator, views it as a lucrative career choice. Andrei, a skilled hacker working for the government, finds power in his ability to infiltrate critical infrastructure. The narrative suggests that Russia's state-sponsored cybercrime is deeply ingrained, with real-life implications for global security and the nation's development.

Takeaways

• 🌐 The script discusses the prevalence of cyberattacks attributed to Russian hackers, targeting a wide range of entities including companies, infrastructure, and political figures.
• 👨‍🎓 It introduces Leonid, a 16-year-old who, disillusioned with school and influenced by a sense of national danger, becomes a 'hacktivist' known as 'Dark Diver', using hacking as a form of protest against perceived foreign threats.
• 🤝 Leonid is part of a growing crew that conducts DDoS attacks, website defacements, and data theft, primarily against targets in countries Russia views as adversaries.
• 💡 The narrative suggests that hacktivist groups like Leonid's are often driven by a mix of idealism, nationalism, and a desire for recognition, using cyberattacks as a means to make a statement.
• 🔒 The script also presents Peter, who engages in ransomware attacks for financial gain, highlighting how some hackers turn to cybercrime out of economic necessity or the allure of quick money.
• 🏢 Peter's story illustrates the rise of ransomware as a business model, where hackers can rent malware and harness social engineering to infect victims, with the implication that some Russian ransomware groups may receive tacit government support.
• 🛡️ Andrei, a high-level hacker working for the Russian military intelligence, represents the state-sponsored aspect of cybercrime, where hacking is a tool of foreign policy and intelligence gathering.
• 🔎 The script explores the Russian government's role in controlling and directing civilian hackers, using them for distraction or as a force multiplier in conducting cyber operations.
• 🚀 It reflects on the potential of Russia's hacker community, suggesting that with different circumstances, these individuals could have been valuable assets in a legitimate IT industry.
• ❓ The script concludes with a critical question about whether Russia can or will change its reliance on cybercrime as a tool of statecraft, suggesting it's an addiction that's difficult to break.

Q & A

What is the primary motivation behind Leonid's hacking activities?

Leonid is motivated by a strong sense of patriotism and a belief that he is defending his country against perceived enemies. He sees himself as a hacktivist, fighting against foreign conspiracies that he believes are responsible for Russia's problems.

How does the script describe the evolution of Peter's hacking career?

Peter started as a hacker for financial gain, using ransomware to infect and extort money from victims. Over time, he became part of a larger operation, where he is expected to follow strict rules about targeting to avoid legal repercussions within Russia.

What is the significance of Andrei's role within the GRU, and how does it differ from civilian hackers?

Andrei is a highly skilled hacker working for the GRU, Russia's military intelligence agency. His work is highly strategic and often targets critical infrastructure and government agencies. This is in contrast to civilian hackers who often engage in hacking for personal gain or political reasons and operate with less sophistication and oversight.

How does the script portray the Russian state's relationship with cybercrime?

The script suggests that the Russian state is complicit in and benefits from cybercrime, using it as a tool of foreign policy and economic gain. It implies that the state is addicted to the quick gains from cybercrime at the expense of developing a legitimate technology sector.

What is the role of hacktivist groups like KillNet and ZAPЯ in the script's narrative?

These groups are portrayed as part of a larger movement of hacktivists who engage in cyberattacks for political or nationalistic reasons. They aim to create publicity and spread fear, often exaggerating the impact of their actions to gain attention and further their agenda.

How does the script explain the rise of cybercrime in Russia?

The script attributes the rise of cybercrime in Russia to a combination of historical factors, including the dissolution of the Soviet Union, economic hardships, and a lack of legal opportunities for skilled individuals, which led many to turn to hacking as a means of income and power.

What are the potential consequences for hackers who target the wrong entities within Russia?

Hackers who target entities within Russia or friendly countries face severe consequences, including loss of business, physical threats from thugs, or even legal prosecution. The script emphasizes that there is a clear line that hackers are not supposed to cross.

How does the script characterize the typical profile of a Russian hacker?

The script characterizes Russian hackers as coming from various backgrounds, ranging from disaffected youth like Leonid, to opportunists like Peter, to highly skilled and disciplined operatives like Andrei. They are driven by different motivations, including ideology, financial gain, and a sense of power and control.

What is the significance of the '90s era in shaping the current Russian hacking landscape according to the script?

The script suggests that the '90s was a formative period for Russian hacking, marked by economic turmoil and a proliferation of unlicensed software. This era created a generation of skilled hackers who were motivated by the power and opportunity that hacking provided, setting the stage for the current landscape of cybercrime.

How does the script suggest that the Russian state could potentially change its relationship with cybercrime?

The script implies that Russia could shift away from its reliance on cybercrime by investing in the development of a legitimate technology sector, fostering ethical hacking, and redirecting the skills and energies of its citizens towards productive ends.

Outlines

00:00

🌐 The World of Russian Hackers

The paragraph introduces the narrative by discussing a recent cyberattack attributed to Russian hackers. It sets the stage by describing the various targets of these hackers, including companies, infrastructure, and politicians. The story then shifts to focus on Leonid, a 16-year-old from a Russian city who, despite his young age, is deeply involved in hacking activities. Leonid's motivations stem from a strong sense of patriotism and a belief that his country is under constant threat from external forces. He sees himself as part of a larger movement, contributing to a crew that conducts DDoS attacks, probes for vulnerabilities, and engages in various cyber-espionage activities, all targeted at countries perceived as enemies of Russia.

05:05

🎮 From Gamer to Hacktivist

This section delves into the profile of Leonid, portraying him as a typical teenager with interests in games, cars, and music, but with a significant twist. Leonid's narrative is one of transformation from a regular student into 'Dark Diver,' a member of a hacking group. The paragraph explores the dynamics of the group, its growth, and the various cyber tactics they employ, such as DDoS attacks and data theft. It also touches on the psychological aspect, where Leonid sees his hacking activities as a form of activism, driven by nationalistic sentiments and a desire to protect his country from perceived Western threats.

10:08

💼 The Evolution of a Hacker: Peter's Story

The narrative introduces Peter, an individual in his 30s who has turned to hacking as a means of livelihood. Unlike Leonid, Peter's motivations are more financially driven. He engages in ransomware attacks, leveraging social engineering to expand his network of infected devices. The paragraph outlines Peter's journey from a conventional job seeker to a full-fledged participant in cybercrime, highlighting the ease with which one can enter the world of hacking and the allure of quick financial gains. It also discusses the broader implications of ransomware on a national and international scale, suggesting a certain level of tolerance or even encouragement from the Russian government towards such activities.

15:09

🏢 Andrei: The Elite Hacker with Military Ties

The paragraph shifts focus to Andrei, a highly skilled hacker with a background in computer engineering who works for the GRU, Russia's military intelligence agency. It contrasts Andrei's sophisticated and high-stakes hacking activities, which include targeting foreign governments and critical infrastructure, with those of less skilled individuals. The narrative underscores the strategic use of cyber operations by the Russian state, where the line between military and civilian hackers is blurred. Andrei's story serves to illustrate the professionalization and organization of cybercrime within the Russian context, as well as the powerful draw of control and influence that hacking provides.

20:09

🌍 The State of Cybercrime in Russia

This section discusses the broader context of cybercrime in Russia, suggesting that it is an integral part of the country's foreign policy, economy, and societal structure. It highlights the role of various Russian institutions, including the GRU, FSB, and SVR, in conducting cyber operations and the complex relationship between state-sponsored and independent hackers. The paragraph also touches on the historical context, including the rise of hacking in the 1990s and the current state of sanctions and embargoes that have influenced the reliance on unlicensed software and cybercrime as a means of survival and power.

25:20

🔄 The Cycle of Addiction: Russia's Future in Cybercrime

The final paragraph contemplates the future of Russia's relationship with cybercrime, posing questions about the possibility of change and the potential for Russia to shift from a cybercrime hub to a productive technology hub. It reflects on the implications of the current state of affairs for the nation and its people, suggesting that the path of cybercrime offers a quick but ultimately unfulfilling high. The narrative concludes with a call to consider the long-term consequences of maintaining the status quo and the need for a potential shift in direction.

Keywords

💡Cyberattack

A cyberattack refers to any attempt to access a system, network, or device without authorization with the intention of causing damage or disruption. In the video, cyberattacks are portrayed as a frequent activity by Russian hackers, targeting various entities such as companies, infrastructure, and governments. The script mentions a 'massive cyberattack' at the beginning, setting the stage for the exploration of Russian hacking culture.

💡Hacktivist

A hacktivist is an individual who conducts cyberattacks for a political agenda or a cause, often framing their actions as a form of civil disobedience or protest. The video introduces Leonid, a young hacktivist who sees himself as defending his country against perceived external threats. His activities, such as DDoS attacks and website defacement, are driven by a mix of nationalism and personal grievances.

💡DDoS

DDoS stands for Distributed Denial of Service, a cyber attack technique that involves overwhelming a target system with a flood of traffic to disrupt its services. The script describes how Leonid and his crew use a botnet to perform DDoS attacks, jamming target servers and taking them down as part of their hacktivist activities.

💡Botnet

A botnet is a network of compromised computers controlled remotely by a hacker to perform coordinated attacks, such as DDoS. In the video narrative, Leonid's crew uses a botnet to amplify the impact of their attacks, illustrating the scale and organization that botnets can provide to cyber threat actors.

💡Ransomware

Ransomware is a type of malicious software that encrypts a victim's data and demands payment to restore access. The script mentions ransomware as one of the tools used by hackers to inflict damage and extract financial gain from their targets, highlighting the dual nature of cyber threats as both politically motivated and financially driven.

💡Dark Web

The dark web refers to parts of the internet that are not indexed by traditional search engines and require specific software to access. It is often associated with illegal activities, including the sale of hacking tools. The video describes how Leonid's crew buys traffic from dark web vendors to boost their attacks, showing how the dark web facilitates cybercrime.

💡Phishing

Phishing is a social engineering tactic used to deceive individuals into revealing sensitive information, such as login credentials. The script includes phishing as part of the hackers' arsenal, emphasizing how they use a combination of technical and psychological tactics to compromise targets.

💡Cybercrime

Cybercrime encompasses a broad range of illegal activities conducted online, including hacking, fraud, and theft of information. The video presents a bleak view of cybercrime as a pervasive and integral part of Russian foreign policy and economy, suggesting a systemic issue rather than isolated incidents.

💡State-sponsored

State-sponsored hacking refers to cyberattacks conducted by individuals or groups with the support or direction of a nation-state. The video implies that some of the hacking activities described may be state-sponsored, hinting at the complex interplay between individual hackers and government interests.

💡Addiction

In the context of the video, addiction is used metaphorically to describe the compulsive and damaging nature of cybercrime. It suggests that both individual hackers and the state are hooked on the immediate gratification that cybercrime provides, at the expense of long-term societal and economic health.

💡Cybersecurity

Cybersecurity pertains to the measures taken to protect computer systems and networks from attacks, theft, or damage. The video underscores the importance of cybersecurity by depicting the extensive efforts required to counter the sophisticated and varied cyber threats originating from Russia.

Highlights

A massive cyberattack is attributed to Russian hackers, targeting companies, infrastructure, and politicians.

The narrative introduces Leonid, a 16-year-old from a Russian city, who sees himself as part of a movement against perceived enemies of Russia.

Leonid, under the alias 'Dark Diver', engages in DDoS attacks and other cyber activities as part of a growing crew.

The crew's operations include DDoS attacks, website defacement, data theft, and ransomware deployment, primarily against countries Russia considers enemies.

Hacktivist groups like Leonid's aim for publicity, using social media to amplify the impact of their attacks.

Peter, a character in his 30s, resorts to hacking as a means to earn money and live a comfortable life.

Peter's method involves using ransomware and leveraging social engineering to expand his network of infected devices.

The video discusses the economic drivers behind ransomware attacks, including the impact of sanctions on Russia.

Andrei, a high-ranking government hacker, is portrayed as part of an elite group within the Russian military intelligence.

Andrei's work includes high-level cyber espionage and attacks on critical infrastructure, demonstrating the power dynamics in cyber warfare.

The video explores the Russian government's role in controlling and directing cyberattacks, including the use of civilian hackers for state objectives.

The narrative suggests a potential alternative for Russia to become a hub for ethical hacking and cybersecurity, contrasting with its current reputation.

The video concludes by questioning whether Russia can overcome its reliance on cybercrime as a state policy.

The characters are fictional but are based on real insights into the Russian hacking community, highlighting the complexity of motivations and state involvement.

The video calls for reflection on the impact of cybercrime on Russia's international image and the well-being of its people.

Transcripts

Have you heard the news?

Just a few minutes ago, there was a massive cyberattack.

Evil hackers struck a major company.

Or was it a government institution?

Maybe a hospital?

But whatever their target was, the authorities were certain of one thing,

those hackers, well, they were Russian.

Anywhere you look, you'll find their trace.

Companies, infrastructure, politicians.

They hack it all.

Nobody can escape them.

And nobody can catch them.

But how do they hack?

Who do they work for?

And most importantly, who are they, really?

To find that out, let's dive into the dark world of Russian hackers.

Meet Leonid.

He's a 16-year-old from a large Russian city.

Leonid spends his mornings at school, although he doesn't like it very much.

While there, he yearns to return home, to a sprawling suburb

where his mom's apartment is.

Leonid doesn't go out much, though.

He spends most of his time on the computer.

He loves games, cars, war movies, and cool music.

Leonid also loves his country.

He's not into politics, not at all.

But he knows one thing.

His country is in grave danger.

It is, as everybody surely should understand, beset by enemies.

Clues about that are everywhere: on TV, on the Internet, all over the place.

Everything aligns.

Everything shows that the whole world is against Russia.

The only goal of the entire West

is to destroy Leonid's country and its people.

Well, at least that's what Leonid reads on the internet and sees on TV.

He's absolutely sure that everything bad that ever happened in Russia

is the result of foreign conspiracies.

Corrupting Western influence

is why Leonid's father had problems with alcoholism and had to leave.

It's why the economy is stagnating, and the family is barely holding on,

even despite the payouts.

It's why Leonid no longer has a brother.

Not everybody in Leonid's immediate vicinity

understands the connection, though, and it frustrates the boy immensely.

He wants to act, to do something.

Leonid's brother wanted to act too, and join the army.

Leonid is neither as brave nor as stupid as that. No.

He knows that if you want to defeat Russia's enemies, you have to be smart.

And so when he returns home from school, Leonid becomes somebody else.

He becomes the Dark Diver.

He's just a cog in a much bigger movement. He knows that.

But Leonid learns fast.

The crew he belongs to is growing.

Just a few months ago, there were a handful of them.

Now it's dozens.

Together, they can do a lot.

Higher ranking members of Leonid's gang are smart.

They follow the news and have a good grasp of what's what.

Every few days, they lay out a set of targets and create a plan.

The group mostly does DDoS, Distributed Denial of Service.

They use a botnet, a collection of infected devices all across the world

to send requests and jam the target server, taking it down.

The crew's botnet isn't very big, but it's enough for some tasks.

Whenever they need something more powerful,

they chip in and buy some traffic from a vendor on the dark web.

Leonid's crew also probes websites and looks for a chance to deface them,

or maybe steal some data.

They scrape leaks for credentials and sometimes send out phishing emails.

Anything that would allow them to get to the target.

On a rare occasion, they infect the computer of their target

with ransomware, making it unusable.

Their techniques are varied, and so are their targets.

But there's one thing that ties those targets together.

All of them, every single one,

are in the countries Russia considers its enemies.

One target may be an institution of some European country

whose leadership said something bad about Russia.

Another one may be some American company,

because, of course, America is the main enemy of Russia.

Every other day, the target is in Ukraine, because that's just how the world works.

Every time they attack Ukraine, Leonid remembers his brother.

And thinks about how proud he would be.

Leonid considers himself a hacktivist,

one of thousands across the country and beyond.

I think if you were to use a sports analogy,

hacktivists are your minor league players.

They are often students or grad students or recent graduates,

who are trying to make a name for themselves.

They're trying to distinguish themselves with bold tacks.

Usually, idealistic, nationalistic, driven individuals with an agenda.

Hacktivist used to be independent, so they used to be something like

an individual groups that work on behalf of their leaders, of their teams,

of their beliefs, let's call it this way, in what they wanted to achieve.

The most famous one being KillNet, ZAPЯ, something like Anonymous Russia,

that's been on the news lately.

Again, why we're speaking about news because that's what's their aim.

They want to pop up, to be noticed, people to talk about their activity.

Chances are, if you've heard about some prominent

and annoying cyberattack recently, Leonid's group was responsible for it.

Not because the attack itself was damaging,

but because the group found a way to spin it.

They chose a target that would be easily noticeable,

something you couldn't just ignore.

Then they attacked it using the easiest way possible.

Whether the attack succeeded or not,

they posted about it on their social media.

The post exaggerated the whole story a bit.

Or maybe quite a lot.

But who's going to check anyway?

In the blink of an eye, the story was picked up

by every other hacktivist group, spreading it farther and farther.

Eventually, influencers, news accounts, all kinds of people began sharing it.

Before long, the news about the attack reached papers and TV channels,

and now everybody has heard of the operation Leonid's gang pulled off.

By that time, the effects of the attack have probably been mitigated,

but that's not the point.

The publicity, the buzz, the sense that their targets are vulnerable

and the gang can do everything,

that's the intention.

The end goal of Leonid's operation

is to cause as much arbitrary damage as possible,

to be the agents of chaos,

who see doubt, anger, and mistrust in everything they touch.

In Leonid's mind, that's the only way to fight the enemy,

who's as strong as the one they are fighting,

the West, as in the entirety of it.

All the governments, companies, and people

that belong to this nebulous and ever-changing group.

Because if you're in Russia,

every bit of information you get points to one thing.

They are responsible for the woes of the Russian people.

Leonid hates the West with the entirety of his heart,

and directs his angst to these long nights in front of the computer.

They give his life meaning, and he can't imagine things any other way.

In a sense, he's addicted to hacking.

The feeling it gives him, the thrills, the satisfaction,

the rush of adrenaline when something large crashes and burns.

Video games can't provide this kind of joy,

and real life doesn't even come close.

Leonid never felt this kind of camaraderie with his school buddies,

and he no longer has friends beyond other hackers in the gang.

As the boy dawns his alter ego, he is no longer alone.

He's no longer in a crumbling apartment block

on the outskirts of the city. He's in a tribe, a team,

a community that strives to change the world for the better,

one downed American website, one interrupted European service,

one jammed Ukrainian server at a time.

So far, Leonid did never consider earning money for his hacking endeavors.

But one day, if it all goes well, that may happen.

At least, there are people who managed to pull it off.

This is Peter.

He lives in the same apartment block as Leonid,

although they don't really know each other.

Peter is in his 30s.

He doesn't work anywhere. At least officially.

Well, he tried many times, but that didn't last.

Being a desk drone drove Peter mad,

so he quit even before Russia's IT market disintegrated.

An office job also didn't really meet Peter's financial needs.

Peter is not very good with money.

He loves nice things, maybe a bit too much.

Who can blame him?

Back in school, Peter's teacher always said that he's smart but lazy.

But when something interests Peter,

he can be the most hard-working person in the world.

Having nice things interests Peter a lot,

and so he found a job that can fulfill his needs

and give him an outlet to his talents.

Peter began hacking.

Not real hacking, at least not how some of Peter's superiors see it,

more like hacking by proxy.

The job is simple. Convincing as many people as possible

to download a small file.

Peter does that by collecting leaked credentials,

emails, nicknames, passwords.

He then stuffs them into login pages of social media accounts,

looking for matches.

In an unlikely chance of success, the password works,

and Peter adds the unlocked account to his loyal army of robots.

Those robots then do his bidding,

contacting the entirety of their friend list

with a simple message bearing a small attachment.

Most of this process is automated,

and Peter has only a vague understanding of how it works,

but even that understanding is more than enough.

The file Peter sends out is malicious.

It's also so well-designed that a child could use it.

Peter pays a small fee for access to that file.

It's easy, fast, it's like a franchise now.

You can buy a ransomware for a day or for a week,

get rich, that's what they think,

and leave to another country with full bags of money.

But yeah, that's not how it happens in the real world now.

As soon as Peter joined the gang, a few years ago, he immediately got lucky.

A few successful jobs in a row allowed him to get all the things he wanted.

For a while, he was living like a king.

His success ended quite soon, though,

and Peter kept chasing that high ever since.

Successful attacks still happen. Peter can't complain.

At least it's better than trying to find a real job.

Also, he got lucky once, so who says it can't happen again?

These ransomware attacks allow well-educated individuals

to make a lot of money very, very quickly.

With all the sanctions that have taken place within Russia

since the invasion of Ukraine,

it has created even less economic opportunity.

And I think the government in Russia has become even more tolerant

or even supportive of ransomware groups,

because all of these groups are bringing money into the Russian economy.

Law enforcement was never interested in

how ransomware operators earn their income.

Peter is pretty sure the police are well aware of what he does,

but they just don't care about that.

There's only one thing that could bother them,

and that's Peter crossing the line.

A part of Peter's job is to know who his targets are.

And it's an important part.

Anybody who lives in Russia, and friendly countries is off limits.

Larger Russian companies are so far behind the red line

that it's almost as if they don't exist.

Thankfully, most of this process is automated, too.

The malware detects language settings of the victim's device

and doesn't activate if Russian is selected.

However, if the target from Russia gets infected anyway,

Peter might be in trouble.

The bosses then dispatch a team of real hackers,

get in touch with the target, and sort out the problem.

This happened to Peter's victim once.

He got a sizable penalty and doesn't want the story to repeat.

It's pretty well known what happens to habitual line crossers,

people who attack forbidden targets despite the rules.

In the best cases,

they lose their business and have no chance of joining any gang.

Particularly annoying ones get visited by local thugs in the real world.

If a hacker crosses the line one too many times,

if he really steps on the toes of people who shouldn't be touched,

he gets the worst punishment of all,

the law.

Peter doesn't know anyone who's been arrested,

but he sees some of them on the news. The prospect of being paraded

in front of the whole country in handcuffs doesn't look very enticing.

As far as Peter understands, it's not politics.

It's much simpler than that.

You don't attack your own family.

And if you do, well, you only have yourself to blame.

So, Peter picks his targets carefully.

People in the West are much richer anyway, so why even bother with Russian targets?

The ransomware groups grew out of the dissolution of the Soviet Union

I think that the rampant inflation

and the privatization of industries, left a lot of very highly educated people

without a means of making an income,

and they turned to these types of attacks for economic advantage.

While quite new to the whole ransomware game,

Peter considered himself a hacker for a long time.

He got his first computer back in the '90s and quickly learned that

you don't have to pay money for things like video games if you're clever enough.

It was a different time, a wild time.

Back then, Peter couldn't even imagine that hacking can be

as profitable a business as it is now. Well, at least to some.

Everybody knows hackers who earn millions without breaking a sweat.

Someday, after some successful attack, Peter might become one of those, too.

Just one good job to buy a new car.

Maybe a new flat in a nicer part of town, or maybe if things turn out really well,

just leave everything and get away from it all to Dubai, Istanbul, even Europe.

One good job. Peter likes to sit like that

and think about all the nice things he'll get after hitting a jackpot.

But now, he's just noticed that he's all out of cigarettes.

On his way down to the shop, Peter passes the door of a neighbor he's never seen.

The door's always closed.

Peter doesn't know it, but if he ever messes up at work really, really bad,

he might get a chance of finally meeting the man who lives there.

The next chapter is loading,

so you can still hit that subscribe button while we have time.

Okay, almost over now.

Peter's neighbor is Andrei.

Right now, he's at work.

Andrei leaves early and comes back late.

He's divorced in his early 40s and doesn't have friends.

He wouldn't have time for them anyway.

Andrei finished university at the top of his class,

computer engineering.

While studying, he didn't even think about joining the military.

But one day, his class was visited by a recruiter

who offered a very enticing offer.

Andrei is quite good at finding vulnerabilities in computer systems.

There's a need for people with this skill, the recruiter said.

If Andrei wants to earn a passable income, he can join some local tech company

and spend the rest of his life slaving away at a desk job,

always overworked, and always on the verge of getting fired.

Or he could work for the government.

The recruiter was one from the GRU,

the military intelligence of the Russian armed forces.

It responds directly to the general staff, the very top of the Russian military.

Its members aren't your regular soldiers.

They're an elite. The very best Russia has to offer.

Andrei joined and never looked back.

Right now, he's in a grand building in the center of the city,

by a desk where he spends most of his time.

The environment isn't dynamic, but after a decade and a half,

Andrei got used to that.

He likes it, the predictability, the discipline, the order.

He even got used to the uniform, which seemed like overkill at first.

The work itself is hard but satisfying.

You have to learn and adapt.

There are lots of challenges, but that's the cost of being at the top of the game.

Andrei does not just hack things.

He does that on a level only a handful of people in the world ever reach,

and his targets reflect that.

Sometimes, Andrei's unit attacks foreign governments.

They infiltrate agencies, parties,

the very lives of world-famous politicians.

Sometimes, they attack foreign companies,

typically those in the defense or cybersecurity business.

But the most satisfying results come from breaching infrastructure,

breaking into power plants, factories, industrial control networks.

Andrei is in awe of it, the power he feels

when he holds the lives of thousands of people in his hands.

One press of a button, and they're gone.

A mass tragedy, a world war.

A lot rests on one click.

Andrei is addicted to that feeling,

and there's nothing he would agree to exchange for moments like these.

In particular, I think that targeting critical infrastructure,

targeting OT SCADA devices, that's where it all began.

And that's what we see now, a lot of companies in US, for example,

at the moment are being targeted, especially the one that do water supplies.

Of course, everything Andrei does is strictly supervised.

His agency isn't after death and destruction.

What the superiors really need are military and trade secrets.

When necessary, they inflict just enough damage to show that the team was there.

No more, no less.

GRU is just one of many Russian institutions that do this kind of job.

There is the FSB, the Federal Security Service.

Andrei never met their hackers.

But people say they're smug and undisciplined.

Many of them aren't even officers.

There's the SVR, the Foreign Intelligence Service.

Andrei collaborated with them once or twice.

They're competent, but most of their work involves

informational attacks, political espionage and such.

Useless tasks, in Andrei's opinion.

And of course, there are the civilians.

Thousands upon thousands of them.

They're difficult to control, more of a mob than an army.

Some of them hack for political reasons.

Others seek financial gain.

In addition to hacking, Andrei's unit

also controls and orchestrates the civilian attacks,

picks and clears targets, draws lines, and punishes the misbehaving hackers.

I might assume that a lot of hacktivists now, especially in Russia,

they're under government's control.

That's why I was saying about them targeting the same goals.

They might be achieving something like an order

or something like a target they need to hit,

and they are doing this, one by one.

Of course, you wouldn't pick a hacktivist or even a ransomware operator

to do a real hacker's job.

They won't be able to infiltrate a defense contractor

or break into an email server of a political party.

That's the work of Andrei and his colleagues.

But even a disorganized mob of script kiddies still has its uses.

But again, if we try to remember that there is a different goal

for different security operations, then you understand that some operations

are being designed just to showcase that they've been done,

that they were implemented, that the goal was achieved,

and others are staying undercover.

The other reason might be something like when a magician does his trick,

he usually shows something in front,

but the real action is done on the background.

That might be also a trick.

When you try to focus attention of cybersecurity authorities,

let's say in US, into water supply grid,

at the same time, you might be targeting something else.

You put their attention in the other spot just to make sure you do all the action,

all the important action, in quite other directions.

Andrei isn't too pleased with civilian hackers,

but he understands that they're a valuable asset for the country.

They provide cannon fodder, a cheap way to conduct a lot of attacks,

or in the worst case, at least a distraction.

They're also the future.

The kids among them will grow up one day, get bored of hacking for fun.

They'll want a better life and a real purpose to work for.

Andrei used to be just like them back in the day.

In his teenage years, before he was a hacker,

he frequented the same forums as Peter, and unbeknownst to anybody,

a lot of that very convenient software Peter uses,

draws roots from things Andrei wrote in his youth.

It was malware, quick and dirty exploits to be dropped

on the dark web for all to use.

But Andrei's first love was cracking.

Games at first, then work programs, then industrial software

that could be sold to Russian businesses and provide teenage Andrei

with enough money to sustain his hacking hobby.

The percentage of software that is cracked or not properly licensed in Russia,

I would say it's in excess of 90%

if you get into the very sophisticated tools

that are used for designing electronics and mechanical engineering

and chemical engineering and these types of applications.

I think a lot of these things are now embargoed.

You cannot even purchase legitimate copies of these design tools today,

so it's almost forced piracy.

But even before the sanctions went into effect,

Russian industry ran off of unlicensed or cracked software.

But besides money, there was one more thing that this activity provided.

Power.

The first time Andrei felt it,

he was still a teenager, hooked on the internet

through a landline in his parents' flat. He remembers looking at the wire,

a line of metal encased in transparent plastic,

pondering how so much can be done through such a thin connection.

The whole world could fit through there and bend to his will,

with just a handful of clever math tricks.

It was a sense of power Andrei never found anywhere else,

and he hasn't been able to let go of it ever since.

Sure, the '90s in Russia were full of chaos, and poverty.

But Andrei remembers the hacker scene of that time very fondly.

The decade was full of opportunity.

It hooked Andrei on hacking and instilled in him a sense of purpose.

It's that feeling that brought him to the GRU

and gave him the life he has now.

The '90s brought up an entire generation of hackers who had skills and motivation,

who could do so much with so few resources.

If things went differently,

those people would be the backbone of a strong IT industry.

Maybe in some other alternative world, Russia is the cybersecurity powerhouse,

with the most skilled, ethical hackers you can find.

In that world, Andrei is probably heading a prominent cybersecurity company.

Leonid is participating in hacking competitions,

and honing his skills before becoming a well-known researcher.

And Peter works with customers,

helping them solve their problems instead of creating ones.

But that alternative world does not exist.

This reality is all we have.

In it, Russia has no place for ethical hackers.

The easiest path for curious and skilled people is the path of cybercrime.

It's the only way for them to satisfy their addiction.

On addiction, the path both creates and feeds

because the Russian state itself is addicted to cybercrime, too.

It's an integral part of its foreign policy, economy, and life.

A quick high instead of the slow and painful process of development.

Just like any addiction, it's a vicious cycle,

and there's no indication that it's going to stop.

Or maybe there is.

All the characters depicted in this video are fictional.

We created them by combining everything we know about the Russian hacker world

into a few easily understandable bits.

But behind these characters are real people with real lives,

the real Russian hackers.

They are people, people who have their own motivations for what they do,

and who spread fear and misery with a clear and deliberate intention.

Behind those people is a state for which conducting cybercrime

is an official way of doing things.

Crashing websites, pushing ransomware, spreading disinformation,

and advancing its agenda in any way possible.

That's how Russian foreign policy works.

We know quite a lot about the inside life of the Russian hacking scene.

There are insider reports, whistleblowers,

people who infiltrated and researched that world.

And while we don't know a lot about what happens at the very top of it,

we can infer the intentions of the people who are in charge.

However, there is one question which remains open.

Can Russia get rid of its addiction to cybercrime?

Is it not too late to change?

Maybe start investing time and resources into becoming a productive technology hub

and let go of the high that ultimately gets you nowhere.

Well, not doing anything about that is easier, that's for sure.

But is the country, and most importantly, the people in it, better that way?

Thank you for watching, and we'll see you in the next video.