THREAD: Are the @shadowbrokerss and @GUCCIFER_2 the same entity?
1/ @emptywheel claims that multiple people told her that these two personas used the same IP address. I'll assess other evidence that TSB and G2 could be linked and and surmise who is in the group besides "Phil".
2/ Marcy's first mistake is in thinking that "Phil" (Michael L. Adams) left the Icelanderia/G2 comment on her site, when in reality Adams refers to that individual as "the mouthpiece". Here we can assume that Adams and "the mouthpiece" could be associates. emptywheel.net/2020/10/26/par…
3/ The only lead into the identity of TSB is from @AllMattNYT and @theintercept articles, where in early 2017 a Viennese hacker named "Carlo" was able to accurately predict TSB data releases to an American businessman in Germany. nytimes.com/2018/02/09/us/… theintercept.com/2018/02/09/don…
4/ Given these articles came out the day after @edhenry released (American businessman in Germany) Adam Waldman's text messages with @MarkWarner, it's safe to assume that Waldman was the American intermediary in contact with "Carlo". foxnews.com/politics/democ…
5/ Furthermore, Waldman was negotiating an immunity deal for Julian Assange at the same time "Carlo" was seeking his failed immunity deal with the US. Waldman happened to be at the embassy from January 12-13, 2017. thehill.com/opinion/white-… theguardian.com/media/2018/jun…
6/ This time period of Waldman being in the Ecuadorian Embassy is extremely important, because this is the date when TSB and G2 tweeted at 2:31PM in UTC+2 and UTC-4 respectfully and then both went dark. swithak.github.io/SH20TAATSB18/A… archive.is/Em6e1 archive.is/dnFA4
7/ The darkness lasted forever for G2, but TSB came back on April 8, 2017 the day after after Julian's immunity deal fell through. This indicates to me that the TSB/G2 tweets in January were signals to Waldman that "Carlo" had control over the accounts. steemit.com/shadowbrokers/…
8/ Also, that TSB(G2) and @wikileaks were in previous contact and working on their immunity deals together. This is corroborated by Wikileaks claiming to have the cyber weapons before TSB's initial release.
9/ In addition, relating to G2, Assange intimated to @NatSecGeek that he was in contact with the persona's "handlers". This demonstrates to me that "the mouthpiece" might not have access to the full TSB/G2 archives, more on that later... newyorker.com/magazine/2017/…
10/ By the way, Wikileaks told Emma Best that they didn't publish any of the 1Gb of material that G2 sent to them.
11/ INTERMISSION: By this point I'm trying to persuade to you that:
A) Wikileaks and Carlo's immunity pursuits were linked
And
B) TSB's and G2's going dark on the same day were because they have associated handlers
Now going forward let's try to find Carlo/TSB/G2/mouthpiece.
12/ Rosenberg's piece states that Carlo "had previously dealt with American intelligence operatives", this led me to a @kpoulsen article about a Ukrainian hacker named Maksym Popov, who became an asset for a former FBI agent @ejhilbert in the early 2000s. wired.com/2016/05/maksym…
13/ Popov returned to Ukraine in 2003 and ended up double crossing Hilbert and returning to the dark side, adopting various hacktivist personas including @HardcoreCharle, @YamaTough, @theneogod, @Rucyborg, and @nkwtcrew. emma.best/2019/03/20/the…
14/ Best, in the piece above (read it!), drew comparisons between Popov and G2, noting releases of genuine & forged hacked materials à la G2. Also, he was interested in disinfo and a cyberwar, plus was offered early access to Anonymous files from @hxmonsegur. Sound familiar?
15/ It should because "the mouthpiece" clearly had access to files that were eventually released in full by Wikileaks. Now back to Carlo in Vienna, in searching accounts associated with Popov, I found the account @CarlozTheJackal who's "Always in Vienna". Is that our "Carlo"?
16/ Carloz could be Carlo, Popov, or all of the above, but the reason why I think Popov could be "the mouthpiece"/TSB/G2 or an associate is that they're linguistically and stylistically very similar and that Popov started freaking out once I started poking around this subject.
17/ Popov's social media history is archived on Best's site and would be useful to see a forensic linguist compare it to TSB/G2/@LexingtonAl's history. They both use similar abbreviations such as "smth" that @ClimateAudit described to me as "high-entropy". archive.org/details/Maksym…
18/ There is more to the Popov saga that I'm aware of through sources and as Best put it, it's only "80% of the "whole story"". Is Popov "the mouthpiece" of TSB/G2 that Michael Adams described? Did an ex-FBI asset cause much of the turmoil that plagued our politics from '16-now?
19/ Best, Wheeler, and the rest of these journos need to...
ADDENDUM: What about Hal?
I know what most of you all are thinking, "Where does Hal Martin fit into all of this?". Well, what most people don't realize is (besides @walkafyre and I), is that Hal confessed... storage.courtlistener.com/recap/gov.usco…
A2: 30 minutes before the @shadowbrokerss started dumping @NSAGov tools online, Hal (@hal_999999999) messaged a @kaspersky researcher that he wanted to talk to "Yevgeny", who might be @e_kaspersky. politico.com/story/2019/01/…
A3: Some may believe that "Yevgeny" could refer to Yevgeniy Nikulin, given he was arrested the same day Hal's case was unsealed after being postponed, but that is still to be determined. Brush up on Nghia Pho, but back to Martin... justice.gov/usao-ndca/pr/r… nytimes.com/2017/12/01/us/…
A4: Hal's sentencing was overlooked, the handwritten transcript's a coded masterpiece. Harkening back to Michael Adams's "Russia didn't write this APT", Martin taunts @CrowdStrike's @rsethjohnston that he's "an extremely APT pupil". Emphasis on the caps! storage.courtlistener.com/recap/gov.usco…
A5: Furthermore, Hal leaves little to the imagination telling "that curiously interesting and curiously
exciting crowd (counterintelligence and counterespionage?)" that "I don't drink vodka and I'm immune to
Smirnov", and thanks Bob Mueller "for such fancy work". Fancy Bear!
A6: Hal goes on to thank/apologize to Admiral Rogers, Shawn Henry, Ash Carter, Ed Danes, Ingo Swann, and others, while reprimanding "that cool dude, in a loose mood ("the mouthpiece"?). Is this a confession to working with G2/TSB? The world may never know...
A7: "That cool dude, in a loose mood" is definitely "Yevgeny".
A8: Also, the significance of Hal messaging a Kaspersky researcher 30 minutes before TSB's first post, is that the tools were identified on Pho's computer when he used antivirus software made by Kaspersky Lab, and then were later targeted by hackers. wsj.com/articles/russi…
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.