Personally, I would consider that a somewhat extraordinary claim. Is there anyone familiar with this sector who can comment on this?
I think very few people on HN understand how Crowdstrike works. Know how every Fortune-1000 company in the world has McAfee or Norton Antivirus installed (or at least used to)? Crowdstrike is like that, except they hoover up all the malware detection stuff they do on endpoints to a central data center and correlate it across customers.
More seriously, anything not phoning home with traffic patterns for things that 'might be attacks'.
It's fine to explain how malware works and turn it into a PR piece with fancy pictures of minified JavaScript, but none of that is proof of some Russian connection. Neither are professional sounding statements like "we have medium confidence the attackers are Russian actors" or similar baloney.
All there is is Stratfor style analysis along the lines of "we think NATO countries X, Y, Z got exploited so it must be Russia" when in reality that's probably just because all their customers are NATO countries X, Y, Z.
I believe that the industry's identification of APT28 (active since 2007) as a Russian group is based on both the political identities of their targets, and language and timezone indicators leaked in their work. Here is one such analysis from 2014 from a different security company:
https://www.fireeye.com/blog/threat-research/2014/10/apt28-a...
Here's the report for how you might detect APT28 in your network.
What would evidence look like, to you? Do you want to see the PCAPs? The executables themselves?
0. FireEye identifies a threat group known as APT28 (active since 2007) as having Russian origin, based upon political identities of targets, language markers, timezone data, and compiler settings. This analysis is from 2014. [EDIT: added this step later on to solidify Russian attribution] Sources:
- https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... (blog)
- https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... (long-form report PDF)
1. CrowdStrike & SecureWorks identifying the DNC breaches originating from the well-known Russian state threat actor APT28. Sources:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
- https://www.secureworks.com/research/threat-group-4127-targe...
2. This Motherboard article revealing the custom bitly links used in the Podesta phishing email. Sources:
- [OP] http://motherboard.vice.com/read/how-hackers-broke-into-john...
3. Politico confirming with SecureWorks that the Podesta spoofed phishing domain from step 2 has previously been used by threat actor APT28: "'The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,' SecureWorks researcher Tom Finney told POLITICO in an email." Sources:
- http://www.politico.com/story/2016/10/russia-responsible-pod...
This Politico article is the better summary. It also links to 2 other quality corroborating stories from ThreatConnect and Esquire. The Motherboard one is key but doesn't tie the whole story together. Sorry to disappoint parent commenter but the evidence does involve bitly custom domains! I'm not 100% clear whether this was simply a decently-executed vanilla phishing attack or if there were some advanced techniques used, but none of the evidence above hinges on that.