Thread by @ClimateAudit

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers In that post, I mentioned an "Easter egg". I explained the Easter egg in a follow-up post climateaudit.org/2018/03/24/att…. There was an apparent infrastructure link between the Lurk banking gang and the spearphishing campaign attributed to APT28 (Fancy Bear) by SecureWorks.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers registrant of googlesetting[.com] domain used in the 2015 spearphishing campaign analysed by SecureWorks (June 26, 2016) is [e-mail], also registrant for numerous domains in Oct 2014 PWC inventory pwc.blogs.com/files/tactical… of APT28 domains. Connecting spearphish to APT28.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 2/ registrant of accoounts-google[.com, other domain used in 2015 spearphishing campaign, is "Gennadiy Borisov" with email [e-mail], used in scores of crimeware domains associated with Lurk's Angler exploit kit.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 3/ this parallel structure is an otherwise unreported and startling connection between (Russian) Lurk Banking gang and the spearphishing campaign analysed by SecureWorks in connection with DNC hack. See climateaudit.org/2018/03/24/att… and climateaudit.org/2018/03/11/arr…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 4/ there's another fascinating connection between Lurk Banking Gang and DNC hack which has been reported, but little discussed. (I was unaware of it when I wrote my long article on Lurk Banking Gang last year.)

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 5/ Konstantin Kozlovsky, one of the leaders of the Lurk Banking Gang, under arrest since June 2016, claimed that he hacked the DNC under directions of the FSB (not the GRU who were indicted by Mueller)
fastcompany.com/40538571/jaile…
fortune.com/2017/12/11/rus…
mcclatchydc.com/news/nation-wo…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 6/ there's been considerable skepticism on Kozlovsky's claim e.g. several analysts in Daily Beast article thedailybeast.com/should-we-beli…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 7/ FWIW, it seems to me that the parallel infrastructure (see discussion) above might provide some additional support for this theory. But Kozlovsky is just beginning of even stranger story.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 8/ Kozlovsky said that his handler was FSB's Dmitry Dokuchaev. In Dec 2016, Dokuchaev was charged with treason, along with Sergei Mikhailov, Dokuchaev's FSB boss, and Ruslan Stoyanov of Kaspersky (who had led arrest of Lurk gang) for passing info to US foreignpolicy.com/2017/01/31/arr…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 9/ when arrested, Sergei Mikhailov has $12 million in cash at his house. Also, his biography was reported to be fraudulent - startling for a senior FSB officer. "Sources" reported that he had been "originally recruited by the Americans during a vacation"
dailymail.co.uk/news/article-4…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 10/ one of the earliest articles on arrests meduza.io/en/feature/201… speculated on a "mind-bendingly elaborate plot".

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 11/ reporter Irek Murtazin summarizes that, at first glance, "the FSB appears to be encouraging suspicions that its officers and agents were involved in a cyber-attack on the United States", but points out that the story has a "false bottom".

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 12. suppose that Kozlovsky's orders to hack the DNC originated from Mikhailov, who has been charged by Russians for being a US agent. "mind-bendingly elaborate", indeed.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 13/ it seems possible that the arrested FSB officials might well have given information to US intelligence blaming GRU for the hack. I wonder what is really known about any of this,

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 14/ here's another link to a very early article (Dec 2017) article on the arrests
novayagazeta.ru/articles/2017/…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 14/ the Russian articles say that Kozlovsky's hack was Crowdstrike's Cozy Bear, not Fancy Bear. Mueller's charges were limited to the Fancy Bear hack. The Cozy Bear hack was conspicuously absent.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 14/ fascinating as this seems, this too has a catch. A more recent article (Oct 2018) says that Mikhailov and his accomplices received $10 million from FBI for information about Pavel Vrublevsky, the former head of the payment services company Chronopay.
meduza.io/en/news/2018/1…

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers 15/ @_mzishi_ links fascinating Dec 29/18 article linkedin.com/pulse/double-a… which says that (US spy) #SergeiMikhailov was in charge of bitcoin BTC-e (and Russia's entire online WebMoney, crypto and otherwise) and that US lost control of exchange when Mikhailov arrested.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers @_mzishi_ 16/ Article also asserts that (CIA agent) #SergeiMikhailov "supplied American security services with the IP addresses that linked Fancy Bear to the DNC hack". Tangled story indeed.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers @_mzishi_ 17/ tracing the LinkedIn article to its Russian source m.lenta.ru/articles/2018/…. It states that "BTC-E exchange, as well as the entire hacker network in Russia" was controlled by #SergeiMikhailov.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers @_mzishi_ 18/ Lenta.ru article also stated that Mikhailov supplied CIA with "IP addresses of supposedly Russian hackers, from which the correspondence of Hillary Clinton's headquarters was hacked" and that, since Mikhailov worked for CIA, BTC-e "served interests" of CIA.

@2xwide_dreaming @dr_davidsmith @wakeywakey16 @Larry_Beech @taleof2servers @_mzishi_ 19/ another important point that I should have mentioned earlier. Arrests of Dokuchaev and Mikhailov came soon after arrest of Shaltai Boltai leader Vladimir Anikeev in Oct 2016. Anikeev was arrested after being lured from Ukraine to Moscow.