U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Northern District of California.
- Primary Target Sector: Internet Services, Telecommunications.
- Documented Financial Loss: $350.0 million.
- 3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.
Root Cause & Infiltration Vector
Adversary gained initial access via Spearphishing Link: Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials.
Operational Impact & Financial Blast Radius
Resulted in $350,000,000 in documented financial liabilities. Breach reduced Verizon's acquisition price of Yahoo by $350 million and required $117 million in class action settlement funds.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials.
Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords.
Adversaries stole Yahoo's proprietary user database containing names, email addresses, cryptographic salts, and hashed passwords.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Indictment unsealed charging two FSB officers (Dokuchaev, Sushchin) and hackers Alexsey Belan and Karim Baratov.
Baratov arrested by Canadian authorities in Hamilton, Ontario.
Baratov pleads guilty to nine counts of computer hacking and wire fraud conspiracies.
Baratov sentenced to 60 months (5 years) in prison and fined $250,000.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Karim Baratov | Canadian and Kazakh | sentenced | 60 mo | None | Hacker-for-hire who worked with Russian FSB agents in the Yahoo breach. Sentenced to 60 months in prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1566.002 | Spearphishing Link Initial Access | "Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials." | Indictment ¶ 22, Page 12 | reviewed |
| T1078 | Valid Accounts Defense Evasion | "Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords." | Indictment ¶ 31, Page 18 | reviewed |
| T1003 | OS Credential Dumping Credential Access | "Adversaries stole Yahoo's proprietary user database containing names, email addresses, cryptographic salts, and hashed passwords." | Indictment ¶ 27, Page 15 | reviewed |