Same Russian hackers likely breached Olympic drug-testing agency and DNC

The cybercriminals who defaced the World Anti-Doping Agency (Wada) website after it triggered a ban on Russian athletes at the Rio Olympics were likely the same hacking team behind the breach of the Democratic National Committee revealed in July, according to hacking experts.

Wada issued a scathing report on the Russian government’s vast cover-up of doping during the Sochi games in 2014 after Grigory Rodchenkov, a doctor who had worked for Russia’s own anti-doping authority, said he helped cover the tracks of athletes using anabolic steroids during the games. Two of Rodchenkov’s former colleagues including the one-time head of the agency, Nikita Kamayev, died in February.

Cybersecurity researchers at ThreatConnect believe the hacker was “Fancy Bear”, a hacking team long suspected of ties to Russian security agency GRU. Fancy Bear breached Wada in apparent retaliation against whistleblower Yuliya Stepanova, the Russian sprinter who spoke out against what she described as the practice of helping athletes cheat in exchange for a percentage of their earnings, according to ThreatConnnect.

ThreatConnect’s Toni Gidwani, formerly of the US Defense Intelligence Agency, told the Guardian that the breach came after the revelation of widespread cheating by Russian Olympians. ThreatConnect issued a report on the breach last week.

The hack was “thuggish”, she said, but as is usual with Fancy Bear, the very public attack masked an intended chilling effect: “We also think there’s very much an element of retaliation against Yuliya Stepanova,” Gidwani said. “They attacked her email, they got her records out of Wada. There’s very much a retaliatory aspect to it and a way of intimidating anybody who might be thinking about speaking out.”

The specific intimidation campaign against Stepanova is well-documented. A spokesman for Russian president Vladimir Putin has called her a “Judas”. “They moved after the hack and the former head of the Russian anti-doping agency died under mysterious circumstances,” Gidwani notes. “It’s like a bad spy novel.”

But Rodchenkov’s revelations had their intended effect: ordered by the International Olympic Committee to investigate his claims, Wada reported in July that the Russian government colluded across multiple agencies and authorities to cover up widespread use of performance-enhancing chemicals including a cocktail of the anabolic steroids metenolone, trenbolone and oxandrolone.

Olympic athletes may seem like small fry for a state-sponsored hack, but Gidwani says athletics are far more important to the government than non-Russians realize. “Going back to the Sochi Games in terms of just how much corruption was involved in putting on the games, and even going back to Soviet times, sport was a way to curry favor with the power elite,” Gidwani said. “There’s a stronger connection between sporting players and key political figures than we would think in the US. That is the context that helps explain these kinds of actions.”

Fancy Bear attacked the DNC, and the Hillary Clinton presidential campaign, in a broad attack revealed earlier this summer. But the splashy nature of that intrusion – a person or people using the online handle Guccifer 2.0 distributed tidbits from the breach to reporters – revealed a second intruder, codenamed Cozy Bear by ThreatConnect.

Cozy Bear, which has also been linked to the Russian intelligence services, came to prominence last year following hacks of the state department and White House networks.

Gidwani says she’s heard very little from Cozy Bear as her firm tracks malware and phishing attacks. “If I put on my tinfoil hat for a minute, that’s one of the things that kind of concerns me,” Gidwani said. “Fancy Bear has been so noisy that we’re not focusing on Cozy Bear as much.”