Quick Facts
Biography
Alisa Shevchenko (Russian: Алиса Шевченко), also known as Alisa "Esage" Shevchenko and Alisa Esage, is a Russian hacker, known for working with companies to find vulnerabilities in their systems. A self-described “offensive security researcher,” she focuses on finding vulnerabilities, including zero-days. According to a 2014 profile in Forbes Russia, Shevchenko was more drawn to hacking than programming. After dropping out of school she worked as a virus analytics expert for Kaspersky Labs for five years. In 2009, she founded the company Esage Labs, later known as ZOR Security. (the Russian acronym stands for Цифровое оружие и защита, “Digital Weapons and Defense.”)
Shevchenko was placed on US sanctions list for allegedly ‘helping Vladimir Putin bid to swing the [2016] election for Trump’. Regarding White House accusations that Shevchenko had been involved in hacking the US election, in an interview Shevchenko is on record as noting that authorities either misinterpreted facts or were deceived.
Achievements
Shevchenko launched the Moscow based Neuron Hackspace and was the winner of the PhDays IV, Critical Infrastructure Attack contest, successfully hacking a fake smart city and detecting several zero-day vulnerabilities in Indusoft Web Studio 7.1 by Schneider Electric. Alisa was also awarded the Zero Day Initiative (ZDI), then owned by U.S. tech giant HP, for uncovering two vulnerabilities in Microsoft products in 2014. Her work has been featured in noted security industry publication virus BULLETIN.
Motivation and personality
Regarding her driving motivations, Alisa Shevchenko has said: "It's kinda ironic that I am still aspiring to inspire women, an obvious anti-hero." She has also made statements implying a clever and subversive wit, such as: "I wonder what @google is doing as a government-"ltd" global player, while some big gov'ts are clashing in the absurdity show."
Connections
Private security firm Wapack Labs, part of the corporate/cyber intelligence sharing community Red Sky Alliance, claim a former employee of Shevchenko company ZOR Security was responsible for the BlackEnergy virus. The BlackEnergy virus has been used against targets in Georgia and Ukraine, prior to Russian invasions of these nations. Poland and Belgium have also been targeted by the malware. Attacks using the BlackEnergy virus and other malware thought to have been created by the same person or persons, or by connected persons, have been linked using the security services codename Sandworm.
Publications and exploits
- The Art of Exploitation in Phrack Inc.
- Microsoft Windows Media Center CVE-2014-4060 Remote Code Execution Vulnerability in SecurityFocus
- (0Day) Microsoft Word Line Formatting Denial of Service Vulnerability in Zero Day Initiative
- RootkIt Evolution in SecureList
- Case Study: the Ibank Trojan in virus BULLETIN
- MS14-067 MSXML Remote Code Execution Vulnerability CVE-2014-4118 in Microsoft Security TechCenter
- Microsoft XML Core Services CVE-2014-4118 Remote Code Execution Vulnerability in SecurityFocus