Uber Cyber Tree

Uber Cyber “Tree”, also known as “SPRUC_3”, “Spruce 3”, “3ntity”, and “Entity” == This is a decentralized Anonymous network of “Blackhat” hackers which is anti-NATO in political position. Spruce-3 is linked to numerous hackers throughout Europe.

Its criminal activity includes infiltration and exploitation of banking vulnerabilities, stealing large amounts of “virtual money” later converted into bitcoins, illegal cryptocurrency mining, money laundering, and "Dark Wallet" operations. The financing network and channeling of funds have not yet been identified. Spruce 3 successfully mounted a complex center of operations in the Onion Tor network (DeepWeb), using encrypted access to establish a secure communication network on the “darknet”.

Spruce 3’s motto is “The backbone of surprise is fusing speed with secrecy”. They act quickly and decisively against voices raised in support of NATO and the EU, or in protest of GBCC policies and agreements. Common internet users believe the myth that Spruce 3 sees all, acting as the sword of justice, cutting down all cyber unfairness towards Bothnian interests. The organization appears to be a decentralized, anonymous global network of ‘blackhat’ hackers pushing a Bothnian agenda. It is believed they are composed of extremely high skilled individuals on all cyber subdomains with university level degrees and ages comprised between 25 – 45 years old. Recruitment and training happens in Arnish, Bothnian, and Torrikan universities and in conferences and workshops. Analysts identified crypto and stenographic puzzles as a form of recruitment of like-minded people with enough technical knowledge to crack the puzzles.

Spruce 3 leadership is known as “3ntity”, or “Entity”. The “white–hat hacker” community agrees that Spruce 3 may be led by one individual, a series of individuals, or none at all. This means Spruce 3 may operate on orders given from a centralized third-party actor; state figure or private group. There is no substantial information available regarding the organization of Spruce 3, besides the fact that there is high probability that Spruce 3 is a system of systems, decentralized, possibly controlled by a state figure or a private group. Spruce 3 may have specialized nodes in different domains, responsible for new targets and tailor made jobs. This organization acts world-wide and is believed to have members across the globe.

Spruce 3 appears to focus on offensive cyber capabilities, like penetration tools, SCADA attacks, DDOSs, floods and disruption of critical sewage, water, electrical and transport (SWET) systems. They have the knowledge and capability to exploit vulnerabilities in NATO AGS, AGS ground stations, NAEW, and attacking NATO’s Mission Network. Spruce 3 may have tampered with avionics software, compromising the safety and efficiency of the air missions. They also conduct anti-NATO/anti-EU disinformation campaigns.

Spruce 3 methods of operation include:

• Organization and planning done through a series of VPNs possibly connected to Onion and IP2 networks, allowing for a high level of anonymous and difficult to trace activity
• Disrupting SWET systems by injecting custom made C2 protocols through malware
• Standard cryptographic protocols to deliver C2 payloads
• File deletions
• File and directory
• Credentials manipulation
• Multiband Communications
• Brute Force Tactics
• Exfiltration protocols
• Manipulation of AIS systems; software hijacking of freights and cruise liners; ability to hijack and control military UAVs.