{
  "id": "case-khusyaynova-lakhta",
  "slug": "us-v-khusyaynova-project-lakhta",
  "title": "U.S. v. Elena Alekseevna Khusyaynova (Project Lakhta)",
  "summary": "Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.",
  "case_number": "1:18-mj-00464",
  "court": "U.S. District Court for the Eastern District of Virginia",
  "district": "E.D. Va.",
  "country": "United States",
  "opened_at": "2018-09-28",
  "status": "fugitive",
  "victim_sector": "Electoral Systems, Social Media, Public Institutions",
  "victim_country": "United States",
  "loss_amount_usd": 35000000,
  "loss_amount_note": "Managed an operating budget exceeding $35 million for covert information warfare activities.",
  "first_seen_at": "2014-04-01T00:00:00Z",
  "last_updated_at": "2026-07-25T11:00:00Z",
  "actor_slug": "project-lakhta",
  "defendant_slugs": [
    "elena-khusyaynova"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1584",
      "evidence_excerpt": "Operatives purchased thousands of virtual private servers and compromised proxy networks in the United States to disguise Russian origins.",
      "evidence_locator": "Criminal Complaint \u00b6 24, Page 12",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Complaint: U.S. v. Khusyaynova",
      "source_url": "https://www.justice.gov/opa/pr/russian-national-charged-interfering-us-political-system",
      "technique_name": "Compromise Infrastructure",
      "tactic": "Resource Development"
    }
  ],
  "events": [
    {
      "event_type": "indictment",
      "event_date": "2018-09-28",
      "description": "Criminal complaint filed charging Khusyaynova with conspiracy to defraud the United States."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion originating from targeted infiltration directed against Electoral Systems, Social Media, Public Institutions networks. Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.",
    "blast_radius": "Managed an operating budget exceeding $35 million for covert information warfare activities. Impacted Electoral Systems, Social Media, Public Institutions infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Infiltration",
        "title": "Perimeter Ingress",
        "description": "Operatives secured access to victim infrastructure within the Electoral Systems, Social Media, Public Institutions sector.",
        "technical_artifacts": [
          "Network perimeter logs"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Execution",
        "title": "Payload Deployment",
        "description": "Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.",
        "technical_artifacts": [
          "Malicious payload"
        ],
        "mitre_technique_id": "T1486"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}