Stolen U.S. drone documents found for sale on dark web

Analysts with Recorded Future say the stolen drone documents appear to be legitimate, having come from an enlisted captain that's currently stationed at a Nevada-based U.S. Air Force facility.

Sensitive U.S. military drone blueprints and training documents were recently posted for sale on the dark web, according to Boston-based data analytics and intelligence firm Recorded Future.

Analysts with Recorded Future say the stolen drone documents appear to be legitimate, having come from an airman who is currently stationed at a Nevada-based U.S. Air Force facility. The information was apparently breached through a known, outdated router vulnerability that affects a product made by computer networking company NetGear.

The stolen documents include the names of active Air Force personnel in addition to other technical information, Recorded Future said. Leaks containing such information — about people involved in a specific military unit — would typically be considered a counterintelligence threat.

The drone blueprints provided unclassified yet sensitive information about the MQ-9 Reaper, a drone that is currently used for both surveillance and armed combat operations by the U.S. and its allies. The MQ-9 was originally developed by defense contractor General Atomics.

The disclosure highlights the risks posed to systems that store technology manuals, schematics and other military documents which hold value to foreign governments, black market dealers and others.

The FBI and Defense Department’s CIO office did not respond to a request for comment about Recorded Future’s findings. The hacker responsible is also believed to be in possession of Pentagon material related to an improvised explosive device (IED) briefing.

A blog posted Wednesday by Recorded Future reads: “[On June 1,] an English-speaking hacker claimed to have access to export-controlled documents pertaining to the MQ-9 Reaper unmanned aerial vehicle (UAV). Insikt analysts engaged the hacker and confirmed the validity of the compromised documents. Insikt Group identified the name and country of residence of an actor associated with a group we believe to be responsible.”

Recorded Future say it has been working closely with law enforcement to provide evidence of the breach. The company is largely staffed by former U.S. law enforcement and intelligence professionals and is backed by the CIA’s venture capital investment arm.

While Recorded Future declined to name the user or the forum where the blueprints were posted, analysts have documented several of the hacker’s conversations. In one exchange, the hacker claimed to have access to live, in-flight footage shot from a drone that may still be operated by a government agency. That claim, which would suggest the hacker had wide access to a possibly classified network, could not be verified by analysts.

Others have been interested in stealing secrets about General Atomics’ technology for years.

In February, an Associated Press investigation found that Russian-linked hackers had heavily targeted employees of General Atomics since at least March 2015 with specially tailored phishing emails. The hackers were believed to be associated with a group known as “Fancy Bear” or “APT28,” which may be best known for breaching the Democratic National Committee in the run up to the 2016 U.S. presidential election.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure