GRU close access cyber operation against OPCW Genmaj. O. Eichelsheim Defence Intelligence & ecurity ervice 4 October 2018 Unclassified / For Official Use Only Use Official For / Unclassified 2 Tuesday 10 April 2018 ( Arrival from Moscow at Amsterdam chiphol Airport Unclassified / For Official Use Only Use Official For / Unclassified 3 Tuesday 10 April 2018 ( Accompanied by embassy personnel Unclassified / For Official Use Only Use Official For / Unclassified 4 Overview of Russian persons ( Diplomatic passports Unclassified / For Official Use Only Use Official For / Unclassified . Ale/sei MORE0E1 Name 2 Ale/sei ergeyvich MORE0E1 Da e of bir h: 3130731577 Place of bir h: Moermans/aya Oblast Passpor nr: 10013...6 Role: Cyber operator Only Use Official For / Unclassified 6 Evgenii ERE7RIA8O9 Name 2 Evgenii Mi/haylovich ERE7RIA8O9 :a./.a. ERE7RYA8O9) Da e of bir h: 2630731581 Place of bir h: 8urs/ Passpor nr: 10013.... Role: cyber operator Only Use Official For / Unclassified 7 Oleg O10I8O9 Name 2 Oleg Mi/haylovich O10I8O9 Da e of bir h: 2430831572 Place of bir h: Ulyanovs/ Passpor nr: 120018866 Role: HUMI01 support Only Use Official For / Unclassified 8 Alexey MI0I0 Name 2 Alexey 9aleryevich MI0I0 Da e of bir h: 2730.31572 Place of bir h: Perm Oblast Passpor nr: 120017.82 Unclassified / For Official Use Only Use Official For / Unclassified Role: HUMI01 support 5 Car rental agreement Citro?n C3, PA35343R Unclassified / For Official Use Only Use Official For / Unclassified 10 Car rental agreement Citro?n C3, PA35343R Unclassified / For Official Use Only Use Official For / Unclassified 11 Reconnaissance of OPCW and surroundings ( Photos ta/en on 11 April, found on MI0I0Bs camera Unclassified / For Official Use Only Use Official For / Unclassified 12 Reconnaissance of OPCW and surroundings ( Photo ta/en on 12 April, found on MI0I0Bs camera Unclassified / For Official Use Only Use Official For / Unclassified 13 Reconnaissance of OPCW and surroundings ( Photo ta/en on 13 April, found on MI0I0Bs camera Unclassified / For Official Use Only Use Official For / Unclassified 14 ituation map ( Cocation of rental vehicle on Ariday 13 April Unclassified / For Official Use Only Use Official For / Unclassified 1. Unclassified / For Official Use Only Use Official For / Unclassified WiAi panel16 Connected to2 antenna 3 martphone :covered) :4G) 3WiAi panel antenna 7ag with battery Computer 1ransformer E)uipmen in car ( WiAi3hac/ set up in trun/ of rental car Specialis e)uipmen in vehicle ( WiAi3antenna concealed under jac/et on hat shelf ( etup for hac/ing WiAi connections Only Use Official For / Unclassified ( Part of eDuipment with Cyrillic writing 17 chematische weergave Unclassified / For Official Use Only Use Official For / Unclassified 18 WiAi panel antenna ( Hidden under coat Unclassified / For Official Use Only Use Official For / Unclassified 15 7attery ( Power supply for eDuipment ( Purchased in 1he Hague Unclassified / For Official Use Only Use Official For / Unclassified 20 Unclassified / For Official Use Only Use Official For / Unclassified 21 Unclassified / For Official Use Only Use Official For / Unclassified 22 Opera ional modus operandi ( ecurity awareness ( 1ried to destroy smartphone during disruption operation Only Use Official For / Unclassified 23 Opera ional modus operandi ( ecurity awareness ( GRU intelligence officers too/ their trash out of their hotel Only Use Official For / Unclassified rooms 24 Opera ional modus operandi ( Cash money2 20.000 EuroBs and 20.000 dollars Unclassified / For Official Use Only Use Official For / Unclassified 09,04,2018 OPCW 0.:09:462. 09,04,2018 h ps://www.google.ru/maps/search/OPCW/142..11112123.50.8125235 0.:09:46 09,04,2018 Organi5a ion for he Prohibi ion Chemical Weapos 0.:10:16 09,04,2018 Organi5a ion for he Prohibi ion Chemical Weapos 0.:10:16 09,04,2018 h ps://www.google.ru/maps/search/Organi5a ion6for6 he6Prohibi ion6Chemical6Weapos/142..11112123.50.8125235 0.:10:16 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:1. 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:1. h ps://www.google.ru/maps/place/Organisa ion6for6 he6Prohibi ion6of6Chemical6Weapons/152.0909624.281098321.z/da a783 09,04,2018 m184b184m583m481s094.c5b0c.e15ee8.f:09fa.c.523f39a9e0c88m283d52.0909684d4.28328. 0.:10:1. 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:2. 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:2. h ps://www.google.ru/maps/place/Organisa ion6for6 he6Prohibi ion6of6Chemical6Weapons/152.09013624.28190321.z/da a784 09,04,2018 m583m481s094.c5b0c.e15ee8.f:09fa.c.523f39a9e0c88m283d52.0909684d4.28328. 0.:10:2. 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:32 09,04,2018 Organisa ion for he Prohibi ion of Chemical Weapons 0.:10:32 h ps://www.google.ru/maps/place/Organisa ion6for6 he6Prohibi ion6of6Chemical6Weapons/152.090056924.282224821.z/da a 09,04,2018 784m583m481s094.c5b0c.e15ee8.f:09fa.c.523f39a9e0c88m283d52.0909684d4.28328. 0.:10:32 09,04,2018 The :ague Marrio :o el 0.:10:39 09,04,2018 The :ague Marrio :o el 0.:10:39 09,04,2018 The :ague Marrio :o el 0.:10:39 09,04,2018 The :ague Marrio :o el 0.:10:39 h ps://www.google.ru/maps/place/ The6:ague6Marrio 6:o el /152.090056924.282224821.5/da a784m1281m683m581s094.c5b0c .e15ee8.f:09fa.c.523f39a9e0c82s Organisa ion6for6 he6Prohibi ion6of6Chemical6Weapons88m283d52.0909684d4.28328.83m481s 09,04,2018 090:09c44f.f20fe9c50..88m283d52.090029884d4.2824558 0.:10:39 Online searches from SEREBRIAKOV@s lap op ( Indicating interest in OPCW headDuarters building and immediate surroundings Unclassified / For Official Use Only Use Official For / Unclassified 26 Addi ional specialis e)uipmen ( Carried by ERE7RIA8O9 Only Use Official For / Unclassified ( Intended for hac/ing WiAi networ/s 27 Sony Aperia F3311 ( Activated on 5 April, through cell tower in Moscow :G M MCC2 2.0 M0C2 20 Only Use Official For / Unclassified CAC2 27813 CID2 157675381) 28 GRU Cell tower CID: 19.6.9381 ( 0earest cell tower to /nown GRU barrac/s at 8omsomols/y Prospe/t 20, Only Use Official For / Unclassified Moscow 25 0esviEhs/iy Pereulo/ GRU MORENETS@ a9i receip ( Arom 0esviEhs/iy Pereulo/ to Moscow heremetyevo airport Unclassified / For Official Use Only Use Official For / Unclassified ( Date2 10 April 2018 30 Rear en rance of BRU barracCs ( Opening onto 0esviEhs/iy Pereulo/ Only Use Official For / Unclassified 31 Previous opera ions: pho o on SEREBRIAKOV@s lap op ( 14 August 20162 Olympic Games in 7raEil :picture above ta/en on 16.35, 143083 Only Use Official For / Unclassified 2016 with CG383.0ds) 32 Name Manag Gateway Mac Location Network Name Type First Connect Last Connected ed DNS Suffix Address Profile GUID (LAT/LON) Wireles 2016-09-17 2016-09-17 Unche <éíìîíìíÝ B4-E9-B0-C9- {7D30FD49-1E32-4618-8278- Airport, Khimki, _Sheremetyevo Wi-Fi s 19:10:57 +00:00 19:10:57 +00:00 cked îàí > 1E-40 AFF127C2F288} Russia Wireles 2016-09-20 2016-09-20 Unche 00-90-0B-29- {FC1F8A2C-7959-4C0A- Lausanne, LP_Public s 20:17:39 +00:00 20:29:12 +00:00 cked lausanne-palace.net 02-D7 AE0D-6ACAAA049420} Switserland Wireles 2016-09-20 2016-09-22 Unche 00-1A-A2-9F- {7E6EC1D0-6B1A-467E- Lausanne, Hotel Alpha-Palmiers s 21:26:51 +00:00 08:59:34 +00:00 cked monzoon.net 9C-AE A81D-DFFFF2375E69} Switserland Wireles 2017-12-16 2017-12-22 Unche 90-E2-BA-58- {64746B9B-1E16-4366-AE08- Kuala Lumpur, GMKLhotel s 03:21:01 +00:00 12:39:21 +00:00 cked localdomain ED-FB 38596037B691} Malaysia Wireles 2018-04-10 2018-04-12 Unche hotspot.internet-for- D0-BF-9C-3A- {2B8E00FF-9942-4818-A5B9- Noordwijk, Palace-Hotel-Guests s 22:58:44 +00:00 09:53:14 +00:00 cked guests.com 66-B5 B0FC6DB523D2} Netherlands Wireles 2018-04-12 2018-04-13 Unche <éíìîíìíÝ 50-9A-4C-6A- {01E8FAC9-4419-4B38-80B9- The Hague, Marriott_GUEST s 19:08:00 +00:00 14:12:52 +00:00 cked îàí > F0-E5 9A9F896A5415} Netherlands Previous opera ions: WiFi connec ions made by SEREBRIAKOV@s lap op ( Grand Millenium Hotel :8uala Cumpur, Malaysia) from 16 to 22 December 2017F ( Alpha Palmiers Hotel :Causanne, witEerland) from 20 to 22 eptember 2016F ( Palace Hotel :Causanne, witEerland) on 20 eptember 2016. Unclassified / For Official Use Only Use Official For / Unclassified 33 Aus rasse2 3.00 Spie52 09,04,2018 0.:03:01 h ps://www.google.ru/maps/place/Aus rasse263.006Spie526ED0EA8ED0EB2ED0EB5ED0EB9ED1E 86ED0EB0ED1E80ED0EB8ED1E8F/146.69313112..646.636219.055/da a784m583m481s094.8fadb1ff52 0c9b:09c55f8d818b68164588m283d46.691340884d..6432401Fdcr70 09,04,2018 0.:03:01 h ps://www.google.ru/maps/place/Aus rasse263.006Spie526ED0EA8ED0EB2ED0EB5ED0EB9ED1E 86ED0EB0ED1E80ED0EB8ED1E8F/146.69313112..646.636219.035/da a784m583m481s094.8fadb1ff52 0c9b:09c55f8d818b68164588m283d46.691340884d..6432401Fdcr70 09,04,2018 0.:03:01 h ps://www.google.ru/maps/146.69313112..646.636219.035Fdcr70 09,04,2018 0.:03:0. ho els 09,04,2018 0.:03:14 h ps://www.google.ru/maps/search/ho els/146.69313112..646.636219.035Fdcr70 09,04,2018 0.:03:14 Targe : Spie5 Dabora ory ( 1rain tic/ets to 7ern ( Online searches for pieE laboratory Only Use Official For / Unclassified ( Google3maps print3outs of Russian diplomatic facilities in 7ern 34 Boogle Maps prin ,ou s Only Use Official For / Unclassified (Russian diplomatic facilities in 7ern and Geneva 3. Train icCe s o Swi 5erland ( Departure from Utrecht for 7ern via 7asel Unclassified / For Official Use Only Use Official For / Unclassified ( Planned date2 17 April 2018.