Thread by @hatr

Part of the #VulkanFiles is “Scan-V”, a framework to conduct cyberoperations with greater speed, scale and efficiency. Basically, it's purpose is helping the GRU to achieve its mission. One of the indended end-users seems to be #Sandworm.

sueddeutsche.de/projekte/artik…

At its heart, Scan-V is designed to scour the web for vulnerabilities that are then stored in an “ultra-large” database. When a new operation starts, things like identifying targets and initial entry supposed to be already at the hackers’ fingertips
derstandard.de/story/20001449…

The docs also describe the ability to store e-mails (pst-files), pcaps (network traffic) and network-layouts. Stuff you can’t just scan for externally. Storing info on previously breached targets in case your next task is to hack them again

blog.sekoia.io/sekoia-io-anal…

After having poured through the docs @gabby_roncone said she was reminded of old military movies where commanders place “their artillery and troops on the map … to understand where the enemy tanks are and where they need to strike first to break through enemy lines.”

Described In one of the documents is a chain of command when using Scan. This, to me, is one of the most interesting pieces of info.
The head of operations decides who to target. This info gets passed on to "regional centers", who carry out the mission, report back the results.

For this to make sense, it helps to know that some years ago pre-existing units within the GRU were brought together under a new org-structure called VIO. Cyberoperations are one part, alongside info-ops, espionage and psychological effects.

(According to our sources). There's been talk that specific hacking units are geographically distinct and the way Scan is supposed to work reflects that. Central tasking to regional units. Notably, units like #APT28 and #Sandworm are in Moscow, and are operating on higher level.

Scan “fits comfortably into the organizational structure and the strategic approach of the GRU”, according to an analyst at a european intel agency. “It makes sense to pay attention. Because you then understand way better what the GRU is trying to do”

According to one email, a team from Vulkan visited a military facility in Khimki, the same Moscow suburb where the #Sandworm is based. Sandworm also appears to be “approval party” on a technical document related to Scan, referred to by their unit number, 74455

While it is evident that a tool like Scan would be helpful for (not only) Sandworm, we do not know whether the project is actively used. We do have payments indicating the project was being developed at least until mid-2020.
spiegel.de/international/…
/end

For more on the VIO I recommend reading this article by @gavinbwilde

carnegieendowment.org/2022/12/12/cyb…