Russian criminals had hand in attacks on Georgia

The attacks on Georgia that hit many of the government's websites a year ago, were conducted in close connection with Russian criminal gangs, In addition, the cyber-criminals were probably tipped off about Russia's intent to invade the country, according to a new technical analysis, much of which remains secret.

The stunning conclusions come from the US Cyber Consequences Unit, an independent non-profit research institute that assesses the impact of cyber attacks. A 100-page technical analysis is only being made available to the US government and some cybersecurity professionals, but the organisation did release a nine-page summary early Monday.

The report in part confirms some of the suspicions of observers, who theorised that the distributed denial-of-service attacks (DDoS), which crippled many Georgian websites, had its roots in Russia.

The report was chiefly produced through investigations by the CTO of the US Cyber Consequences Unit, John Bumgarner. It involved analyzing a raft of data collected as the attacks were going on and afterwards. The data included server logs from a variety of stakeholders, some of whom would not share information with each other, said Scott Borg, director and chief economist of the institute.

Russia launched a five-day military campaign in August 2008 that corresponded with Georgia's attempts to assert greater control over the South Ossetia and Abkhazia regions, which have strong ties to Russia. Bombers struck targets throughout the country, and at the same time Georgian media and government sites fell under DDOS attack.

That timing doesn't appear to be a coincidence. The attacks were executed with an efficiency that indicated pre-planning, and the cyberattacks also preceded the first news stories of Russia's military intervention, according to the report.

"Many of the cyber attacks were so close in time to the corresponding military operations that there had to be close cooperation between people in the Russian military and the civilian cyber attackers," the report said. "Many of the actions the attackers carried out, such as registering new domain names and putting up new websites, were accomplished so quickly that all of the steps had to be prepared earlier."