What we learned about Russian and U.S. spycraft from Mueller’s indictment of hackers theintercept.com/2018/07/18/mue…
Here are the main takeaways:
The Russians got caught because they didn't compartmentalize enough. They re-used infrastructure for their separate operations (DCLeaks, Guccifer 2.0, spearphishing, hacks of DCCC and DNC), confirming they were all controlled by the same people
The Russians got caught because they didn't compartmentalize enough. They re-used infrastructure for their separate operations (DCLeaks, Guccifer 2.0, spearphishing, hacks of DCCC and DNC), confirming they were all controlled by the same people
And in my opinion, their biggest screw-up was when they accidentally, only once, logged into the @Guccifer_2 twitter account without a VPN, revealing their real IP address, which belonged to a GRU office building in Moscow thedailybeast.com/exclusive-lone…
The GRU officers developed custom malware called X-Agent which connected back to a leased command and control (C2) server (probably a VPS) in Arizona. After install X-Agent on computers at DCCC and DNC networks, they used this Arizona server to log keystrokes, take screenshots
But they got caught in the act, and it appears the FBI had access to all the data exfiltrated to their C2 server. They knew exactly what was collected, when, and even when the hackers cleared logs from the C2 server. My guess is the hosting provider cooperated with investigation
Likewise, it seems clear from reading the indictment that *many* other companies cooperated and shared their data. My guess is this includes, at least, Bitly, Twitter, Facebook, Google, and WordPress, probably BitPay, probably domain registrars, hosting and VPN providers
I think it's likely that investigators hacked the computers of at least two GRU officers: Ivan Yermakov and Anatoly Kovalev, and made use of their browser history or keystrokes. They knew exactly what Yermakov researched online, and exactly when Kovalev deleted his search history
The Russians mined a block of bitcoin, and got "anonymous" bitcoin in other ways too. But it turns out, bitcoin isn't anonymous! BTC from the freshly-mined block was used to pay for dcleaks.com domain, confirming that other transactions from that block were from GRU
And the fact that most online services that accept bitcoin use cryptocurrency payment providers like BitPay or Coinbase makes it even less anonymous. The Russians re-used email addresses with these payment providers, linking their disparate activities together
And now @WikiLeaks...
WL actually reached out to Guccifer 2.0 asking for dirt on Hillary, not the other way around. They specifically wanted drive a wedge between Hillary and Bernie supporters before the Democratic National Convention
WL actually reached out to Guccifer 2.0 asking for dirt on Hillary, not the other way around. They specifically wanted drive a wedge between Hillary and Bernie supporters before the Democratic National Convention
Guccifer 2.0 then send WL a *plaintext email* with a PGP-encrypted attachment that had instructions for downloading the hacked DNC emails. WL responded in another *plaintext email* saying they received "the 1Gb or so archive" and would publish that week
That week, WikiLeaks published the DNC emails. Then, a short time later, Jullian Assange started the Seth Rich conspiracy theory, in this TV interview, in order to encourage misinformation about his source. His real source was Guccifer 2.0
Finally, the indictment includes the exact same key information that 26-year-old whistleblower Reality Winner is accused of leaking. This evidence is now publicly being used to indict GRU officers for executing a cyber attack against the US to influence the 2016 election
Shortly before Mueller's team published the indictment, Winner agreed to a plea deal where she'll serve 5.25 YEARS in prison for informing the public that NSA has solid evidence about Russia hacking the US electoral system. If she serves her full term, she'll be free in year 2022
