U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Northern District of California.
- Primary Target Sector: Internet Services, Telecommunications.
- Documented Financial Loss: $350.0 million.
- 3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Case Summary
Executive Summary for Board Members & Leadership
Plain-English Root Cause
Adversary breached the target network via Spearphishing Link. Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials.
Operational & Financial Fallout
Breach reduced Verizon's acquisition price of Yahoo by $350 million and required $117 million in class action settlement funds. Impacted Internet Services, Telecommunications infrastructure and associated victim operations.
3 Critical Boardroom Questions
- 1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
- 2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
- 3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?
Attack Anatomy & Incident Execution
Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.
Adversary breached the target network via Spearphishing Link. Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials.
Adversary Kill Chain Flow
3 Documented PhasesSpearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials.
Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords.
Adversaries stole Yahoo's proprietary user database containing names, email addresses, cryptographic salts, and hashed passwords.
Breach reduced Verizon's acquisition price of Yahoo by $350 million and required $117 million in class action settlement funds. Impacted Internet Services, Telecommunications infrastructure and associated victim operations.
Procedural & Incident Timeline
Indictment unsealed charging two FSB officers (Dokuchaev, Sushchin) and hackers Alexsey Belan and Karim Baratov.
Baratov arrested by Canadian authorities in Hamilton, Ontario.
Baratov pleads guilty to nine counts of computer hacking and wire fraud conspiracies.
Baratov sentenced to 60 months (5 years) in prison and fined $250,000.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Karim Baratov | Canadian and Kazakh | sentenced | 60 mo | None | Hacker-for-hire who worked with Russian FSB agents in the Yahoo breach. Sentenced to 60 months in prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1566.002 | Spearphishing Link Initial Access | "Spearphishing emails with malicious web links were sent to Yahoo employees to steal privileged system access credentials." | Indictment ¶ 22, Page 12 | reviewed |
| T1078 | Valid Accounts Defense Evasion | "Adversaries created forged cryptographic authentication cookies to access Yahoo webmail accounts of targeted individuals without passwords." | Indictment ¶ 31, Page 18 | reviewed |
| T1003 | OS Credential Dumping Credential Access | "Adversaries stole Yahoo's proprietary user database containing names, email addresses, cryptographic salts, and hashed passwords." | Indictment ¶ 27, Page 15 | reviewed |