Cyber Incident Victim: 0v1ru$
Date:
Jul 2019
Location:
Russia
Summary
A hacking group known as 0v1ru$ compromised SyTech, a contractor for Russia's primary security agency, exposing multiple sensitive projects including social media scraping targeting platforms like Facebook and LinkedIn, efforts to de-anonymize Tor browser users, and preparatory work for a sovereign Russian internet infrastructure. The stolen data, shared with the broader hacking collective Digital Revolution and disseminated to media outlets, revealed operational details such as project codenames and managerial roles but reportedly contained no state secrets. Described as potentially the largest breach in the agency's history, the incident highlighted vulnerabilities in intelligence supply chains through third-party contractors, with attackers defacing SyTech's website and mocking the agency's security posture.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On July 13, 2019, the hacking group 0v1ru$ breached SyTech, a major contractor for Russia’s Federal Security Service (FSB), and defaced the company’s homepage with a Yoba Face graphic alongside images purportedly showcasing the stolen data. The attackers exfiltrated internal documents detailing multiple active and exploratory internet surveillance projects commissioned by the FSB. These projects included "Nautilus-S," an initiative to de-anonymize users of the Tor browser launched in 2012 under the FSB-linked Kvant Research Institute; "Mentor," targeting social media scraping from platforms like Facebook and LinkedIn; "Hope," focused on profiling and monitoring job-seekers; and "Tax-3," a blockchain-based system for secure government communications. 0v1ru$ shared the stolen data with the larger hacking collective Digital Revolution, which disseminated the files to media outlets and publicly taunted the FSB on Twitter, suggesting the agency rename one project "Project Collander" due to the breach. Digital Revolution claimed to publish the documents unedited, emphasizing transparency. The BBC later confirmed the breach’s authenticity, reporting that 0v1ru$ had compromised SyTech’s servers and exposed project names like "Arion," "Relation," and "Hryvnia," along with associated SyTech project managers.
The incident represented a significant operational compromise for Russian intelligence, with BBC Russia describing it as potentially "the largest data leak in the history of Russian intelligence services." While no classified state secrets were exposed, the breach revealed the scope of FSB’s internet surveillance ambitions, including technical efforts to undermine privacy tools like Tor and monitor social media activity. Digital Revolution noted this was not their first intrusion against FSB-linked entities, having previously targeted the Kvant Research Institute. The attack underscored persistent vulnerabilities in intelligence supply chains, as contractors like SyTech proved susceptible to infiltration. The FSB issued no public statements regarding the breach. Concurrently, the exposure of "Hope" and "Tax-3" projects coincided with Russia’s legislative push for internet sovereignty, including laws enabling a standalone Russian DNS system (Runet) to operate independently of global infrastructure. The breach did not disrupt these initiatives but highlighted security gaps in their implementation framework. Media analysis emphasized the breach’s symbolic impact, comparing it to Western intelligence contractor leaks, while technical experts observed that the exposed projects aligned with long-suspected Russian surveillance capabilities rather than revealing novel methods.