CASE DOSSIER fugitive

U.S. v. Elena Alekseevna Khusyaynova (Project Lakhta)

Docket: 1:18-mj-00464 Court: U.S. District Court for the Eastern District of Virginia Opened: 2018-09-28 Sector: Electoral Systems, Social Media, Public Institutions

Key Facts

Status
FUGITIVE
Legal disposition
Loss Amount
$35.0 million
Managed an operating budget exceeding $35 million for covert information warfare activities.
Techniques
1
Verified mappings
Defendants
1
Named in charges
  • Legal Status: FUGITIVE in U.S. District Court for the Eastern District of Virginia.
  • Primary Target Sector: Electoral Systems, Social Media, Public Institutions.
  • Documented Financial Loss: $35.0 million.
  • 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Executive Dossier & Incident Forensics
Disposition: FUGITIVE

Incident Overview

Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.

Root Cause & Infiltration Vector

Initial access established against Electoral Systems, Social Media, Public Institutions infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.

Operational Impact & Financial Blast Radius

Resulted in $35,000,000 in documented financial liabilities. Managed an operating budget exceeding $35 million for covert information warfare activities.

Executive Risk Checklist

  • 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
  • 2. Is network microsegmentation enforced between user workstations and core database enclaves?
  • 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Target Sector: Electoral Systems, Social Media, Public Institutions

Incident Execution & Kill-Chain Lifecycle

Sequential reconstruction of intrusion stages from initial infiltration to resolution.

3 Documented Phases
1
Phase 1: Infiltration Perimeter Ingress & Access Establishment
T1078 →

Operatives established unauthorized footholds within target Electoral Systems, Social Media, Public Institutions environments through stolen credentials or perimeter appliance exploitation.

Artifacts: Perimeter access logs Valid accounts
2
Phase 2: Expansion Internal Traversal & Privilege Escalation
T1021.002 →

Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Electoral Systems, Social Media, Public Institutions infrastructure.

Artifacts: Internal administrative sessions Network telemetry
3
Phase 3: Impact Operational Disruption & Incident Resolution
T1078 →

Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.

Artifacts: Incident response logs Forensic timeline

Standard of Care Remediation & Hardening

Empirical engineering takeaways and preventative controls derived from this incident.

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.
✓ Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.
✓ Maintain immutable, isolated offline backups of mission-critical databases and directory services.
✓ Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel.

Procedural & Incident Timeline

2018-09-28 indictment

Criminal complaint filed charging Khusyaynova with conspiracy to defraud the United States.

Named Defendants & Operatives

Defendant Nationality Status Prison Term Restitution Notes
Elena Alekseevna Khusyaynova Russian Federation fugitive Pending None Chief financial accountant for Project Lakhta information warfare operation.

Substantiated MITRE ATT&CK Techniques

Technique ID Technique Name & Tactic Primary Source Evidence Excerpt Locator Verification
T1584 Compromise Infrastructure
Resource Development
"Operatives purchased thousands of virtual private servers and compromised proxy networks in the United States to disguise Russian origins." Criminal Complaint ¶ 24, Page 12 reviewed

Cite & Embed This Case Record

Public Domain / CC0
Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Elena Alekseevna Khusyaynova (Project Lakhta), No. 1:18-mj-00464 (U.S. District Court for the Eastern District of Virginia 2018), https://cybercaselibrary.com/cases/us-v-khusyaynova-project-lakhta/
Embeddable Incident Card (HTML):
<iframe src="https://cybercaselibrary.com/embed/case/us-v-khusyaynova-project-lakhta/" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>