The Vulkan Files

The leak, disclosed on March 30, 2023, provided an unprecedented look into the operational cyber capabilities of Russian state actors. The documents, originating from NTC Vulkan, detail projects like 'Amesit,' which automates disinformation campaigns and can manipulate social media personas, and 'Skan,' a sophisticated network scanner targeting global infrastructure such as SCADA power grids and air traffic control. Furthermore, the files established a direct contractual link between NTC Vulkan and Military Unit 74455, the unit historically associated with the NotPetya malware, confirming the commercialization of state-level cyber espionage and sabotage tools.

The leak emerged amid heightened geopolitical tensions regarding Russian cyber aggression. It built upon previous disclosures linking Russian state actors to major cyber incidents, such as the NotPetya attack. The documents suggest a systematic, commercialized approach to cyber warfare, moving beyond ad-hoc attacks to structured, deployable toolsets.

The documents describe advanced capabilities, including GSM/GPS signal manipulation and the ability to map vulnerabilities in SCADA systems. 'Skan' is presented as a reconnaissance tool designed for pre-attack intelligence gathering, while 'Amesit' focuses on the Information Environment Control (IEC) domain, indicating a multi-layered approach combining physical, digital, and psychological warfare.

Vulnerabilities exploited

• SCADA systems vulnerabilities
• Air traffic control network weaknesses

MITRE ATT&CK techniques

• T1566.001
• T1046

NTC Vulkan is identified as a Russian defense contractor, suggesting its tools are state-funded and designed for military application. The leak implies that the company functions as a commercial arm for the Russian Ministry of Defense's cyber offensive capabilities.

Aliases

• Vulkan_Whistleblower

APT designations

• Sandworm

MITRE groups

• T1566.001

Attribution sources

• Anonymous

Additional victims

• GRU
• FSB

Countries affected

• United States
• Europe
• Russia

Data types

• Technical Specifications
• User Manuals
• Contractual Agreements
• Classified Documents

Notable documents

• Project Amesit Technical Specifications
• Project Skan Overview
• GRU/FSB Contract Portfolio

Public reaction

The leak caused immediate alarm within the cybersecurity community, highlighting the professionalization and commercialization of state-sponsored cyber warfare. It fueled international calls for stricter export controls on dual-use technology.

Political impact

The disclosure intensified Western scrutiny of Russia's military-industrial complex, particularly its cyber defense contractors. It provided concrete evidence for policymakers regarding the scope and sophistication of Russian cyber offensive planning.

Geopolitical consequences

The files reinforced the narrative of Russia's use of cyber tools not merely for espionage, but for pre-positioning for kinetic conflict, escalating international tensions and hardening cyber deterrence policies.

No immediate legal action was reported, but the leak contributed to ongoing international discussions regarding the legal status of cyber-warfare tools and the accountability of state-sponsored entities.

Policy changes

• Increased focus on critical infrastructure resilience (SCADA/ATC systems)
• Calls for stricter international export controls on dual-use cyber technology

Regulatory changes

• Enhanced national cybersecurity standards for critical infrastructure sectors

Security improvements

• Mandatory segmentation of Operational Technology (OT) networks from IT networks
• Improved monitoring for disinformation campaign indicators

Significance

The Vulkan Files are significant because they moved the discussion of cyber warfare from theoretical capability to documented, commercialized product lines. They provided a blueprint of state-level cyber offensive planning, detailing tools for everything from disinformation (Amesit) to physical infrastructure sabotage (Skan).

Legacy

The leak solidified the understanding that modern cyber conflict is a multi-domain, commercialized industry. It accelerated the global push for 'cyber resilience' and highlighted the urgent need for international legal frameworks governing cyber-weapons.

Media partners

• Anonymous

Publishing organisations

• Anonymous

Related events

• NotPetya Attack
• Fancy Bear/APT28 Disclosures

The documents were leaked and subsequently analyzed by security researchers and journalists, leading to increased public awareness and policy discussions.

Official documents

• NTC Vulkan Project Portfolio

References

1. [1]Vulkan_Whistleblower Disclosure
2. [2]Cybersecurity Threat Reports (2023)