Thread by @ClimateAudit

1/ the number of "coincidences" in Russiagate never cease to amaze. In this thread, I'll discuss a surprising link between analysis of the 2015-2016 spearphishing campaign(which caught Podesta and others) and Ukrainian InformNapalm operatives. Precise meaning unclear
@Stranahan

2/ on June 16, 2016, the day after Crowdstrike's reveal article, SecureWorks secureworks.com/research/threa… reported tht they had been using bitly links to monitor a spearphishing campaign, which, between mid-March and mid-May had targeted both hillaryclinton.com and gmail accounts

3/ in a second article secureworks.com/research/threa… on June 26, 2016, SecureWorks described the techniques of the spearphishing campaign, providing several intriguing examples.

4/ in their first example, they report that, in mid-2015, they had discovered use of typosquatting domain accoounts-google[.]com, illustrating the syntax of the phishing command with incident 3160715 at phishtank.

5/ they continued their analysis by showing that the URL contained
"two Base64-encoded values", which "match the Gmail account and its associated Google Account username", showing difeitalia.canberra[@]gmail.com as example.

6/ from the narrative, nearly all readers would presume that the decoded URL in the second figure corresponded to the spearphishing email in the first figure, but it doesn't. Tracking the actual target in the incident reported in first figure is interesting.

7/ First, for good order, the rest of SecureWorks article reported that the expression in the phishing email had been saved as a bitly expression, showing the association in one figure and the base64 expression in a second figure.

8/ the base64 expression can be conveniently unpacked online using base64decode.org. Actually, it's the person doing the search (aksana) that's most interesting. (Target was bohdan.oryshkevich[@]gmail.com : kyivpost.com/author/bohdan-… twitter.com/ykramerezha

9/ aksana, the person doing the inquiry illustrated by SecureWorks, made other inquiries at PhishTank phishtank.com/user_submissio…. She is Aksana Dymchenko of Informnapalm google.com/search?rlz=1C1…

10/ on Feb 28, 2015, Aksana verified a prior phishtank search by "sjinks" on the phishing site googlesetting[.]com - a site firmly associated with accoounts-google[.com]. sjinks is Volodomyr Kolesnikov of Informnapalm - see twitter.com/sjinks and github.com/sjinks

11/ Aksana Dymchenko facebook.com/people/%D0%90%… is pals with Oksana Tinko facebook.com/oxanatinko who hosts the sinister site Myrotvorets.

12/ Aksana Dymchenko, Vladimir Kolesnikov, Oksana Tinko and others are all discussed in "Technical Report" cyber-berkut.org/docs/%D0%A2%D0… by Cyber Berkut blogpost "CyberBerkut hacked web-sites of Anton Gerashchenko" in Oct 29, 2015 cyber-berkut.org/en/olden/index…

13/ to close the circle, SecureWorks' spearphishing example was uploaded by Ukrainian InformNapalm activist who promoted Ukrainian hacking. What are odds of that? @gheliason