4. Terrorism Source Reports
DIPLOMATIC INFORMATION REPORT
19 JULY 2019
ISLAND NATION EMBASSY, METROPOLIS CITY, REPUBLIC OF YORK
FROM: ISLAND NATION DEFENCE ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS//HDQS
SERIAL: TW4-DIR-001
MINISTRY OF FOREIGN AFFAIRS//REGIONAL DESK OFFICER
MINISTRY OF DEFENCE HDQS
MINISTRY OF DEFENCE OPERATIONS CENTER
MINISTRY OF INTERNAL SECURITY
FOREIGN SECURITY SERVICE
SUBJECT: GREAT BEAR CYBER OPERATIONS IN SOUTH AMNESIA: YORKIAN ARMY LIAISON REPORT
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: OFFICIAL YORKIAN ARMY LIAISON OFFICER IN THE COURSE OF OFFICIAL DUTIES
METROPOLIS CITY — GREAT BEAR FEDERATION HACKERS WERE IDENTIFIED IN A YORKIAN MILITARY REPORT COMPLETED TUESDAY AS THE SOURCE OF COORDINATED CYBER PENETRATIONS OF MORE THAN 50 TARGETS IN THREE DISTRICTS, MANY OF THEM CORPORATE AND GOVERNMENT ENTITIES THAT MANAGE CRITICAL MILITARY, ENERGY, TRANSPORTATION AND MEDICAL SERVICES.
OVER THE COURSE OF TWO MONTHS, ACCORDING TO CYBERLANCE, A SECURITY FIRM BASED IN METROPOLIS CITY, GREAT BEAR FEDERATION HACKERS MANAGED TO STEAL CONFIDENTIAL DATA FROM A LONG LIST OF TARGETS AND, IN SOME CASES, INFILTRATED VICTIMS’ COMPUTER NETWORKS TO SUCH AN EXTENT THAT THEY COULD TAKE OVER, MANIPULATE OR EASILY DESTROY DATA ON THOSE MACHINES. CYBERLANCE CALLED THE ATTACKS “OPERATION BEAVER” BECAUSE THE WORD BEAVER FREQUENTLY APPEARED IN THE ATTACKERS’ MALICIOUS CODE.
THE HACKERS USED A SET OF TOOLS THAT CAN SPY ON AND POTENTIALLY SHUT DOWN CRITICAL CONTROL SYSTEMS AND COMPUTER NETWORKS, AIMING THEM AT MILITARY, GOVERNMENT, AND TRANSPORTATION INFRASTRUCTURE TARGETS IN SOUTH AMNESIA, SERENITY, AND THE AREAS NORTH OF METROPOLIS CITY. THE ATTACKS CAUSE MINIMAL DAMAGE AND MAY THEREFORE HAVE BEEN RECONNAISSANCE ACTIVITY. TRANSPORTATION IN METROPOLIS CITY WAS NOT AFFECTED.
END REPORT
INTELLIGENCE REPORT
14 JULY 2019
ISLAND NATION EMBASSY, FREDONIA CITY, FREDONIA
FROM: ISLAND NATION DEFENCE ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS HDQS
SERIAL: TW4-IR-001
MINISTRY OF FOREIGN AFFAIRS (REGIONAL DESK OFFICER)
MINISTRY OF DEFENCE
MINISTRY OF INTERNAL SECURITY
FOREIGN SECURITY SERVICE
SUBJECT: GREAT BEAR CYBER OPERATIONS IN SOUTH AMNESIA
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: YORKIAN SENIOR GOVERNMENT OFFICIAL
SENIOR GOVERNMENT OFFICIALS IN ALL AGENCIES HAVE BEEN BRIEFED ON THE RECENT CYBER ATTACKS AGAINST YORKIAN GOVERNMENT INSTITUTIONS. THE DIGITAL FORENSIC REPORT IDENTIFIED GREAT BEAR FEDERATION HACKERS AS THE SOURCE OF COORDINATED CYBER PENETRATIONS OF NEARLY 80 TARGETS IN FOUR DISTRICTS. THE ATTACKS PENETRATIONS WERE TARGETED AGAINST CRITICAL INFRASTRUCTURE AND KEY RESOURCES {CIKR} INCLUDING MILITARY, ENERGY, TRANSPORTATION AND MEDICAL SERVICES.
THE GREAT BEAR FEDERATION HACKERS STOLE CONFIDENTIAL DATA AND DESTROYED SOME NETWORKS. THE ATTACKS WERE NAMED “OPERATION BEAVER” BECAUSE THE WORD BEAVER FREQUENTLY APPEARED IN THE ATTACKERS’ MALICIOUS CODE.
THE HACKERS USED A SET OF TOOLS THAT ARE SO SOPHISTICATED THAT THEY ARE THE EXCLUSIVE DOMAIN OF GOVERNMENTS. THEY ARE ABLE TO TAKE CONTROL OF SCADA SYSTEMS. {* NOTE SCADA IS AN ACRONYM FOR SUPERVISORY CONTROL AND DATA ACQUISITION. SCADA SYSTEMS ARE USED TO MONITOR AND CONTROL A PLANT OR EQUIPMENT IN INDUSTRIES.} THE FOREIGN ENTITY CAN SPY ON AND POTENTIALLY SHUT DOWN CRITICAL CONTROL SYSTEMS AND COMPUTER NETWORKS, AIMING THEM AT MILITARY, GOVERNMENT, AND INDUSTRIAL, WASTE MANAGEMENT, WATER, AND TRANSPORTATION INFRASTRUCTURE TARGETS IN SOUTH AMNESIA, SERENITY, AND THE AREAS NORTH OF METROPOLIS CITY. ONLY A FEW NETWORKS WERE DESTROYED. THE ATTACKS CAUSED MINIMAL DAMAGE.
END REPORT
DIPLOMATIC INFORMATION REPORT
22 JULY 2019
ISLAND NATION EMBASSY, METROPOLIS CITY, REPUBLIC OF YORK
FROM: ISLAND NATION LEGAL ATTACHÉ OFFICE
TO: NATIONAL BUREAU OF INVESTIGATIONS//HDQS
SERIAL: TW4-DIR-002
NATIONAL BUREAU OF INVESTIGATIONS
MINISTRY OF FOREIGN AFFAIRS//REGIONAL DESK OFFICER
MINISTRY OF DEFENCE HDQS
MINISTRY OF DEFENCE OPERATIONS CENTER
FOREIGN SECURITY SERVICE
SUBJECT: YORKIAN INVESTIGATIVE REPORT ON GREAT BEAR CYBER OPERATIONS IN SOUTH AMNESIA
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: OFFICIAL YORKIAN FEDERAL INVESTIGATIONS OFFICER IN THE COURSE OF OFFICIAL DUTIES
— INTERNAL REPORT OF RECENT CYBER ATTACKS FROM GREAT BEAR —
METROPOLIS CITY:
SUMMARY: GREAT BEAR FEDERATION HACKERS RECENTLY LAUNCHED CYBER ATTACKS AGAINST MUNICIPAL AND FEDERAL ENTITIES LOCATED IN YORK. CYBER TARGETS WERE PRIMARILY IN THE METROPOLIS AREA.
EXPERTS ASSIGNED THE CODE NAME OF LUCKYBEAR TO THE GROUP BEHIND THIS HACK, BUT THEY LATER REALIZED THE ATTACKERS WERE AN OLDER GREAT BEAR THREAT ACTOR KNOWN UNDER VARIOUS NAMES IN THE REPORTS OF OTHER CYBER-SECURITY FIRMS, SUCH AS LETHAL EMISSARY, APT007, THREAT GROUP 3390, BRONZE HAMMER, AND IRON HAMMER.
HACKERS REDIRECTED VISITORS OF GOVERNMENT SITES TO MALWARE . YORKIAN RESEARCHERS SAY THE HACKER GROUP LUCKYBEAR USED ACCESS TO THE DATA CENTER TO ADD JAVASCRIPT CODE TO GOVERNMENT SITES, WHICH REDIRECTED USERS TO MALICIOUS SITES HOSTING EXPLOITATION TOOLS SUCH AS SCANBOX AND BROWSER EXPLOITATION FRAMEWORK).
ON THESE SITES, THESE TOOLS WOULD ATTEMPT TO INFECT USERS WITH HYPERBRO, A REMOTE ACCESS TROJAN THAT OPERATED VIA AN “IN-MEMORY” STATE, LEAVING MINIMAL TRACES ON DISK THAT COULD BE IDENTIFIED BY ANTIVIRUS SOLUTIONS. RESEARCHERS SAY THEY FOUND EVIDENCE OF THIS END-USER INFECTION CAMPAIGN TAKING PLACE FROM DECEMBER TO MID JULY. LUCKYBEAR TARGETED IT BEFORE IN PREVIOUS CAMPAIGNS.
LUCKYBEAR HACKED A METROPOLIS CITY ROUTER TO HOST THEIR C&C SERVER ANOTHER DETAIL THAT ALSO STOOD OUT WAS THAT LUCKYBEAR APPEARS TO HAVE HACKED A MICROTIK ROUTER TO HOST THE COMMAND AND CONTROL SERVER OF THE HYPERBRO RAT. ATTACKERS WOULD USE THIS ROUTER TO CONTROL AND RETRIEVE DATA FROM INFECTED VICTIMS, PUTTING AN ADDITIONAL LAYER OF ANONYMITY BETWEEN THEM, VICTIMS, AND FORENSIC INVESTIGATORS.
THIS IS NOT THE FIRST TIME THAT NATION-STATE HACKERS HAVE USED ROUTERS AS PART OF THEIR ATTACK INFRASTRUCTURE, THIS BEING A VERY POPULAR TREND RECENTLY (VPN FILTER), BUT IT IS THE FIRST TIME THEY HOSTED A C&C SERVER ON ONE.
“THE MOST UNUSUAL AND INTERESTING POINT HERE IS THE TARGET. YORK’S NATIONAL DATA CENTER IS A VALUABLE SOURCE OF DATA THAT CAN ALSO BE ABUSED TO COMPROMISE OFFICIAL WEBSITES,” THE REPORT EXPLAINED. “ANOTHER INTERESTING POINT IS THE ROUTER, WHICH WE BELIEVE WAS HACKED SPECIFICALLY FOR THE CAMPAIGN.”
METROPOLIS CITY — GREAT BEAR FEDERATION
END REPORT
-IMMEDIATE-
DIPLOMATIC INFORMATION REPORT
11 JULY 2019
ISLAND NATION EMBASSY, METROPOLIS CITY, REPUBLIC OF YORK
FROM: ISLAND NATION DEFENCE ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS//HDQS
SERIAL: TW4-DIR-003
MINISTRY OF FOREIGN AFFAIRS//REGIONAL DESK OFFICER
MINISTRY OF DEFENCE//HDQS
MINISTRY OF DEFENCE OPERATIONS CENTER
MINISTRY OF INTERNAL SECURITY
FOREIGN SECURITY SERVICE
SUBJECT: SOUTH AMNESIA MILITIA ASSASSINATES LOCAL YORKIAN OFFICIALS
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: OFFICIAL YORKIAN ARMY LIAISON OFFICER REPORT
ON 10 JULY BEGINNING AT 2100HRS, SOUTH AMNESIA COMMANDO TERROR UNITS ASSASSINATED A NUMBER OF YORKIAN LOCAL GOVERNMENT OFFICIALS. FIVE OFFICIALS WERE KILLED IN A COORDINATED SERIES OF ATTACKS ACROSS THE SOUTH AMNESIA DISTRICT. A TOTAL OF SEVEN OFFICIALS WERE TARGETED BUT TWO WERE MISSED. THE TWO OFFICIALS WERE SITTING IN A CAR WHEN TERRORISTS ACCIDENTALLY ATTACKED A NEARBY VEHICLE WITH AN OLD GREAT BEAR FEDERATION RPG. TWO UNNAMED TEENAGERS WERE KILLED IN THAT ATTACK. NAMES OF THE ASSASSINATED OFFICIALS ARE AS FOLLOWS:
- LARRY FINE
- MOW HOWARD
- JOE CURLY HOWARD
- SIDNEY FIELDS
- HILLARY BROOKS
THE TWO INDIVIDUALS WHO WERE UNINJURED IN THE ATTACKS ARE MR. ROBERT BUD ABBOTT AND MR. LOUIS B. COSTELLO. THEY ARE NOW IN YORKIAN PROTECTIVE CUSTODY.
YORKIAN LIAISON OFFICER IS AVAILABLE FOR RECONTACT
END REPORT
INTELLIGENCE REPORT
16 JULY 2019
ISLAND NATION EMBASSY, FREDONIA CITY, FREDONIA
FROM: ISLAND NATION DEFENCE ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS HDQS
SERIAL: TW4-IR-002
MINISTRY OF FOREIGN AFFAIRS (REGIONAL DESK OFFICER)
MINISTRY OF DEFENCE
MINISTRY OF INTERNAL SECURITY
FOREIGN SECURITY SERVICE
SUBJECT: REACTIONS OF FOREIGN COUNTRIES TO THE SITUATION OF TERRORISM IN REPUBLIC OF YORK
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: A SENIOR RANKING FREDONIA MILITARY OFFICER
SOURCE STATES THAT FREDONIA MORALLY, DIPLOMATICALLY, AND POLITICALLY SUPPORTS THE GOVERNMENT OF THE REPUBLIC OF YORK IN ITS STRUGGLE TO DEFEAT TERRORISM. FREDONIA IS PREPARED TO PROVIDE LIMITED MILITARY TRAINING AND LOGISTICAL SUPPORT TO THE YORKIAN MILITARY.
THE FREDONIAN MILITARY LEADERSHIP, MINISTRY OF FOREIGN AFFAIRS, AND NATIONAL SECURITY ADVISORY GROUP ARE AT ODDS AS TO HOW MUCH MILITARY AND INTELLIGENCE COUNTER TERRORISM SUPPORT SHOULD BE PROVIDED TO YORK. THE MFA PREFERS A MUCH LOWER LEVEL OF MILITARY ENGAGEMENT. THE PRESIDENT HAS MADE IT CLEAR THAT FREDONIA MUST HAVE SOME LEVEL OF PLAUSIBLE DENIABILITY IN ITS ACTIONS AND CAN NOT RISK ANGERING THE GREAT BEAR.
ACCORDING TO SOURCE, FREDONIAN MILITARY INTELLIGENCE BELIEVES AN INVASION BY GREAT BEAR FORCES TO SECURE SYLVANIA AND SOUTH AMNESIA IS POSSIBLE BUT HIGHLY UNLIKELY.
END REPORT
-IMMEDIATE-
DIPLOMATIC INFORMATION REPORT
15 JULY 2019
ISLAND NATION EMBASSY, METROPOLIS CITY, REPUBLIC OF YORK
FROM: ISLAND NATION LEGAL ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS//HDQS
SERIAL: TW4-DIR-004
MINISTRY OF FOREIGN AFFAIRS//REGIONAL DESK OFFICER
MINISTRY OF DEFENCE//HDQS
MINISTRY OF DEFENCE OPERATIONS CENTER
MINISTRY OF INTERNAL SECURITY//HDQS
FOREIGN SECURITY SERVICE
SUBJECT: SOUTH AMNESIA MILITIA ASSASSINATES LOCAL YORKIAN OFFICIALS {CONT.} DEBRIEFING OF SURVIVING YORK OFFICIALS.
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: OFFICIAL YORKIAN POLICE LIAISON OFFICER DEBRIEFING REPORT
ON 10 JULY BEGINNING AT 2100HRS, SOUTH AMNESIA COMMANDO TERROR UNITS ASSASSINATED A NUMBER OF YORKIAN LOCAL GOVERNMENT OFFICIALS. FIVE OFFICIALS WERE KILLED IN A COORDINATED SERIES OF ATTACKS ACROSS THE SOUTH AMNESIA DISTRICT. A TOTAL OF SEVEN OFFICIALS WERE TARGETED BUT TWO WERE MISSED. THE TWO OFFICIALS WERE SITTING IN A CAR WHEN TERRORISTS ACCIDENTALLY ATTACKED A NEARBY VEHICLE WITH AN OLD GREAT BEAR FEDERATION RPG. TWO UNNAMED TEENAGERS WERE KILLED IN THAT ATTACK. NAMES OF THE ASSASSINATED OFFICIALS ARE AS FOLLOWS:
- LARRY FINE
- MOW HOWARD
- JOE CURLY HOWARD
- SIDNEY FIELDS
- HILLARY BROOKS
THE TWO INDIVIDUALS WHO WERE UNINJURED IN THE ATTACKS ARE MR. ROBERT BUD ABBOTT AND MR. LOUIS B. COSTELLO. THEY WERE BROUGHT INTO YORKIAN PROTECTIVE CUSTODY AND DEBRIEFED BY POLICE INTELLIGENCE OFFICIALS. AN EXTENSIVE DEBRIEFING TOOK PLACE ON 11 JULY AND MATERIALS WERE PROVIDED TO ISLAND NATION EMBASSY {REPORTING OFFICER} ON 14 JULY. ABBOTT AND COSTELLO HAD LITTLE MORE TO REPORT. THEY SAY THE TERRORIST ASSAULT TEAM CONSISTED OF SEVERAL MEN {AGES APPROXIMATELY 24 – 34}. THREE OF THE MEN WERE PARTICULARLY NOTICEABLE. ONE INDIVIDUAL HAD CURLY RED HAIR AND DID NOT SPEAK BUT CARRIED A HORN. ANOTHER MAN WAS SHORT AND WORE A POINTY HAT. THE THIRD MAN HAD GLASSES, THINK EYEBROWS, AND A BIG, BUSHY MUSTACHE. THE TEAM CARRIED AN OLD ROCKET PROPELLED GRENADE AND SEVERAL GB-47 ASSAULT RIFLES. MR. COSTELLO BELIEVES THAT ONE OF THE TEAM MEMBERS {NFI} CALLED THE RED HEADED MAN BY THE NAME “HARPO”.
ADDITIONAL DEBRIEFING REPORT IS AVAILABLE. {REPORTING OFFICER’S COMMENTS: THE TWO YORKIAN OFFICIALS APPEAR TO BE SUFFERING FROM POST TRAUMATIC STRESS DISORDER AS EVIDENCED BY AN EXCERPT FROM THEIR DEBRIEFING. THE ACTUAL TRANSCRIPT WAS NOT INCLUDED FOR THAT REASON.}
END REPORT
INTELLIGENCE REPORT
18 JULY 2019
ISLAND NATION EMBASSY, FREDONIA CITY, FREDONIA
FROM: ISLAND NATION DEFENCE ATTACHÉ OFFICE
TO: MINISTRY OF FOREIGN AFFAIRS HDQS
SERIAL: TW4-IR-003
MINISTRY OF FOREIGN AFFAIRS (REGIONAL DESK OFFICER)
MINISTRY OF DEFENCE
MINISTRY OF INTERNAL SECURITY
FOREIGN SECURITY SERVICE
SUBJECT: GREAT BEAR FEDERATION DEFENCE ATTACHÉ EXPLANATION OF CURRENT TENSIONS WITH YORK
WARNING: THIS IS AN INFORMATION REPORT, NOT FINALLY EVALUATED INTELLIGENCE
SOURCE: REPORTING OFFICER DISCUSSION WITH GREAT BEAR FEDERATION DEFENCE ATTACHÉ TO THE REPUBLIC OF FREDONIA
THE REPORTING OFFICER HAD CONTACT WITH THE GREAT BEAR FEDERATION DEFENCE ATTACHÉ REPRESENTATIVE TO THE REPUBLIC OF FREDONIA AT A FORMAL RECEPTION AT THE FREDONIAN OF MINISTRY OF FOREIGN AFFAIRS, SCHOOL OF FOREIGN POLICY. THE RECEPTION TOOK PLACE ON 17 JULY, 19:30HRS LOCAL TIME. THE HE DESCRIBED YORKIAN PRESIDENT RUFUS T. FIREFLY AS A MADMAN AND A DICTATOR. FIREFLY WAS RESPONSIBLE FOR CRIMES AGAINST HUMANITY INCLUDING GENOCIDE OF THE GREAT BEAR ETHNIC GROUP IN SOUTH AMNESIA AND MUST BE HELD ACCOUNTABLE. “WHILE THE PEACE LOVING PEOPLE OF THE GREAT BEAR FEDERATION RESPECT THE TERRITORIAL INTEGRITY OF ALL NATIONS; THEY WOULD NOT STAND TO SEE THE PEOPLE OF SOUTH AMNESIA WIPED OFF THE FACE OF THE EARTH SIMPLY BECAUSE OF THEIR CULTURAL BELIEFS AND PRACTICES.” WHEN ASKED WHAT THE FEDERATION EXPECTED AS AN OUTCOME OF THE CURRENT TENSIONS, HE RESPONDED IN A LOUD VOICE “FOR ONCE, PERHAPS THE ISLAND NATION CAN STOP SEEING ENEMIES AROUND EVERY CORNER AND HELP DO WHAT IS RIGHT FOR THESE PEOPLE. IS NOT THIS A BETTER WAY FORWARD THAN HAVING THE FREDONIANS DO YOUR DIRTY WORK FOR YOU?”
{REPORTING OFFICER’S COMMENTS: THE GREAT BEAR FEDERATION DEFENCE ATTACHÉ ABRUPTLY ENDED OUR CONVERSATION. HIS LAST STATEMENT MAY REFLECT A BELIEF THAT THE FREDONIAN MILITARY IS SUPPORTING YORK AT THE BEHEST OF THE ISLAND NATION. THIS IMPRESSION IS MOST LIKELY DUE TO THE FREQUENT TRIPS MADE BY MEMBERS OF THIS OFFICE TO THE FREDONIAN MINISTRY OF DEFENSE IN RECENT WEEKS. IT MAY ALSO INDICATE INCREASED GREAT BEAR SURVEILLANCE {{WHICH IS ALREADY HIGH IN THIS COUNTRY}} AGAINST THIS OFFICE AND OTHER ISLAND NATION EMBASSY PERSONNEL.}
END REPORT