The media image of" evil Russians "in the West was formed in the 20th century, during the Cold War, and was often used not only in movies (the same "cranberry"), but also in public policy. The image itself has been transformed more than once, preserving its semantic core. If before the collapse of the USSR, it had a pronounced military connotation, then in the 90s it was replaced by the" Russian mafia", which meant all the diversity of immigrants from the post-Soviet space.
Instead of the inhabitants of "Russian Brighton", there were new "evil Russians" - hackers. Over the past twenty years, they have been accused, truthfully or falsely, of multi-million dollar theft, influencing US elections, and even blackmailing top officials of states.
This article will analyze the main changes that have occurred with "Russian hackers", both from the point of view of their media image, and from the point of view of objective factors.
Indeed, the composition of Russian hacker groups is very different, and representatives of the entire post-Soviet space can be found in them. Since a hacker's language makes it as likely to identify a country as a baseball bat in a car makes it possible to identify a baseball player, modern researchers and cybercriminalists use a set of metrics and attributes.
Modern forensic analysis is at such a level that experts can not only identify attacks as the activity of a particular group, but also record the transitions of groups or individual attackers from one group to another.
But all this has no meaning in the media environment, since the definition of "Russians" in Western society has been fixed since the days when all Russians were Soviet. It has become a media image that is used to attract the audience to the material and promote certain ideas.
Therefore, despite the best efforts of cybersecurity specialists, Russian-speaking hackers will remain "Russian", since the major media will use this stable narrative as long as it is clear to their target groups.
They serve as the foundation of the foundation that allows us to interpret the activities of criminals as a combination of circumstances, and in some cases-as a form of struggle: class, national, social or any other.
In practice, it turns out that everything is simpler. For example, you can compare any carder with the odious Johnny Dillinger. It's hard to imagine that Dillinger would have walked past a bank and gone to rob, for example, a laundry worker. Although if he had been a small – time crook instead of a Dillinger, it was possible that he would have robbed her as well, since the bank was simply too big for him. The same is true for the hacker – he always wants to hit the maximum possible "jackpot".
Along with the profitability of an attack, the level of its danger is also important. Dillinger often moved from state to state, which, at that time, led to a change in the jurisdiction of the law lords who dealt with him. Therefore, his capture became possible only after the formation of a special group, whose powers extended to the entire territory of the United States.
With hackers, the story is the same – targets that are located in the jurisdiction or countries of their residence are more risky. Because, in those days and now, the statement of a resident of St. Petersburg will be investigated faster and more likely than the statement of a resident of conditional Buenos Aires, provided that the attacker is located in Russia.
From the point of view of principles, modern hackers are not much different from their predecessors, but the external environment has undergone major changes. First of all, the segmentation of the CIS countries and the post – Soviet space as a whole has significantly increased. Secondly, there are more advanced mechanisms of international cooperation in the field of information security, which, if we turn to the case of catching REvil, can be very effective if the group crosses some invisible line. However, in the current conditions of the geopolitical crisis, this cooperation practically does not work.
Cyberspace has changed significantly in 20 years. First of all, in terms of its size and saturation. The same thesis is also typical for hacking methods – they have become more diverse and "deeper", and are constantly updated. Accordingly, if earlier the "face of Russian hacking" was carders, now they are pro-state APT groups, cryptographers and hacktivist communities, whose names appear in the headlines of world publications.
At the same time, it is important to understand that a stable media image has the opposite side of the coin, since both political actors and the media can use it for a variety of purposes. For example, covering up their failures or in order to call into question the security of a particular process, or to compromise the opponent.
"Russian hackers" remains a media brand that has a strong historical and factual foundation, as Russian "black hats" remain a significant threat to foreign companies. However, they are actively being squeezed by their Asian "colleagues", primarily representing China.
From the point of view of the world community and the "broad masses", the attitude towards hackers remains gray. Many continue to see them as "Robin Hoods", fighters for social justice or the interests of the state.
And only the professional community remains a bulwark of common sense, realizing that anyone who puts on a "black hat" is a criminal. And its activities should be evaluated strictly from the point of view of the law, and not from the point of view of nationality, principles or territorial affiliation.
Instead of the inhabitants of "Russian Brighton", there were new "evil Russians" - hackers. Over the past twenty years, they have been accused, truthfully or falsely, of multi-million dollar theft, influencing US elections, and even blackmailing top officials of states.
This article will analyze the main changes that have occurred with "Russian hackers", both from the point of view of their media image, and from the point of view of objective factors.
National question
All cybersecurity experts, without exception, emphasize that it is wrong to say "Russian", since cybercrime is basically transnational, and it is correct to say "Russian-speaking".Indeed, the composition of Russian hacker groups is very different, and representatives of the entire post-Soviet space can be found in them. Since a hacker's language makes it as likely to identify a country as a baseball bat in a car makes it possible to identify a baseball player, modern researchers and cybercriminalists use a set of metrics and attributes.
Modern forensic analysis is at such a level that experts can not only identify attacks as the activity of a particular group, but also record the transitions of groups or individual attackers from one group to another.
But all this has no meaning in the media environment, since the definition of "Russians" in Western society has been fixed since the days when all Russians were Soviet. It has become a media image that is used to attract the audience to the material and promote certain ideas.
Therefore, despite the best efforts of cybersecurity specialists, Russian-speaking hackers will remain "Russian", since the major media will use this stable narrative as long as it is clear to their target groups.
How hackers themselves and their principles have changed
The frontmen of "Russian hackers" in the two thousandth were the so-called" Russian carders", whose activities formed the basis of a number of books and documentaries. At the same time, two stereotypes have become stronger in the mass consciousness:- they "robbed the rich";
- they didn't attack their own people.
They serve as the foundation of the foundation that allows us to interpret the activities of criminals as a combination of circumstances, and in some cases-as a form of struggle: class, national, social or any other.
In practice, it turns out that everything is simpler. For example, you can compare any carder with the odious Johnny Dillinger. It's hard to imagine that Dillinger would have walked past a bank and gone to rob, for example, a laundry worker. Although if he had been a small – time crook instead of a Dillinger, it was possible that he would have robbed her as well, since the bank was simply too big for him. The same is true for the hacker – he always wants to hit the maximum possible "jackpot".
Along with the profitability of an attack, the level of its danger is also important. Dillinger often moved from state to state, which, at that time, led to a change in the jurisdiction of the law lords who dealt with him. Therefore, his capture became possible only after the formation of a special group, whose powers extended to the entire territory of the United States.
With hackers, the story is the same – targets that are located in the jurisdiction or countries of their residence are more risky. Because, in those days and now, the statement of a resident of St. Petersburg will be investigated faster and more likely than the statement of a resident of conditional Buenos Aires, provided that the attacker is located in Russia.
From the point of view of principles, modern hackers are not much different from their predecessors, but the external environment has undergone major changes. First of all, the segmentation of the CIS countries and the post – Soviet space as a whole has significantly increased. Secondly, there are more advanced mechanisms of international cooperation in the field of information security, which, if we turn to the case of catching REvil, can be very effective if the group crosses some invisible line. However, in the current conditions of the geopolitical crisis, this cooperation practically does not work.
Cyberspace has changed significantly in 20 years. First of all, in terms of its size and saturation. The same thesis is also typical for hacking methods – they have become more diverse and "deeper", and are constantly updated. Accordingly, if earlier the "face of Russian hacking" was carders, now they are pro-state APT groups, cryptographers and hacktivist communities, whose names appear in the headlines of world publications.
At the same time, it is important to understand that a stable media image has the opposite side of the coin, since both political actors and the media can use it for a variety of purposes. For example, covering up their failures or in order to call into question the security of a particular process, or to compromise the opponent.
So what changed in the end?
It is important to understand that each region has its own "evil hackers", usually with their own territorial affiliation. However, those who attack the so-called developed countries have gained the greatest fame, due to their economic aspects and large media resources."Russian hackers" remains a media brand that has a strong historical and factual foundation, as Russian "black hats" remain a significant threat to foreign companies. However, they are actively being squeezed by their Asian "colleagues", primarily representing China.
From the point of view of the world community and the "broad masses", the attitude towards hackers remains gray. Many continue to see them as "Robin Hoods", fighters for social justice or the interests of the state.
And only the professional community remains a bulwark of common sense, realizing that anyone who puts on a "black hat" is a criminal. And its activities should be evaluated strictly from the point of view of the law, and not from the point of view of nationality, principles or territorial affiliation.
