Leaked SyTech Documents Detail Russia’s Plans to Control Internet Traffic
Summary
DarkOwl’s analysis of leaked SyTech documents describes Russia’s HOPE project to monitor and route internet traffic, and finds similarities to the Sovereign Internet Law. The documents indicate prototype-scale work; a direct link remains unproven.
Key points
- Hackers identified as 0v1ru$ reportedly accessed SyTech in July 2019 and stole 7.5 TB of data, including documents on projects commissioned by Russian special services.
- The HOPE project ran from 2013 to 2014 and aimed to develop ways to disconnect Russia from the global internet while preserving domestic connectivity.
- The analyzed materials included technical reports and a presentation covering traffic routing, BGP testing, monitoring, filtering, and systems intended for use by ISPs.
- DarkOwl says the documents indicate research goals were achieved at small scale, but do not establish large-scale testing; scalability remained a concern.
- The analysis suggests BGP hijacking could underpin traffic control, but presents this as a possibility rather than a confirmed implementation.
- Russia’s Sovereign Internet Law took effect on November 1, 2019, requiring ISPs to install equipment for routing Russian traffic through state-controlled servers and for deep-packet inspection.
- DarkOwl considers HOPE a likely precursor to the law, while acknowledging that a direct connection cannot be proven; experts cited in the article also question whether nationwide isolation is technically feasible.
Article Details
- Attack Vectors
- DarkOwl researchers interpreted screenshots as suggesting 0v1ru$ used ticketer.py, PSExec, and proxychains to gain access to SyTech's Active Directory server; the specific methods are not confirmed.
- After accessing SyTech's systems, 0v1ru$ copied 7.5 TB of data, deleted it from SyTech servers, and defaced the company's webpage.
- Project HOPE explored BGP hijacking as a possible method for rerouting internet traffic. The article describes this as a likely basis for planned state control, not as a confirmed deployed capability.
MITRE ATT&CK
T1090 · ProxyThe article says screenshots suggest proxychains was used among the tools to gain access; it provides no details about the proxy infrastructure.T1491.002 · External Defacement0v1ru$ defaced SyTech's public webpage during the breach.T1569.002 · Service ExecutionThe article says screenshots suggest PSExec was used among the tools to gain access to SyTech's Active Directory server.
Threat Actors
0v1ru$The article identifies 0v1ru$ as the hacker group that accessed SyTech's server, stole and published data, and defaced its webpage.Digital RevolutionThe article describes Digital Revolution as a separate hacking group that received documents from 0v1ru$ and shared them with journalists; it also reports that the group breached Kvant Research Institute in 2018.
Vendors
Tools
proxychainsAnalysis of screenshots posted by 0v1ru$ suggests that the tools used to gain access were ticketer.py, PSExec, and proxychains.PsExecAnalysis of screenshots posted by 0v1ru$ suggests that the tools used to gain access were ticketer.py, PSExec, and proxychains.ticketer.pyAnalysis of screenshots posted by 0v1ru$ suggests that the tools used to gain access were ticketer.py, PSExec, and proxychains.