Thread by @razhael

I know what infosec twitter will be talking about today. apnews.com/a3144f4ef5ab45…

For several months last year, an undercover operative calling himself Lucas Lambert lured cybersecurity experts to fancy hotels in an apparent effort to get dirt on opponents of Kaspersky Lab.
apnews.com/a3144f4ef5ab45…

If that name sounds familiar, it should. @citizenlab’s @jsrailton says he has found digital connections between Lucas Lambert and another operative, Michel Lambert, that he and I ambushed in New York in January. apnews.com/9f31fa2aa72946…

Michel Lambert, in turn, is alleged by a Canadian lawyer to be the same person as Black Cube agent Victor Petrov. Here’s the lawyer’s filing from last month: documentcloud.org/documents/5750…

Here’s Black Cube’s response to us when I asked whether they were involved in the operation against Kaspersky critics. documentcloud.org/documents/5910…

Meanwhile, I asked @kaspersky a series of questions about this operation. Were they involved in any way? Have they ever hired Black Cube?

Their response: No comment.

Whoever these people are, they tend to, um, recycle the same tactics.

Compare-and-contrast one spy’s approach to NSO case lawyer Christiana Markou and another spy’s approach to Russia specialist Keir Giles. documentcloud.org/public/search/…

Both were invited to supposed conferences in Hong Kong by very similarly named fake companies — NPH Investments versus ENE Investments — under almost identical circumstances (allegedly, the firms’ clients want to pour investment into a new field.)

And while we’re talking about TTPs, I want to chat a bit about how the @AP has spent the last couple of months chasing the phantom companies across the world. medium.com/@rsatter/busti…

In this blog post I talk a bit about the tools reporters can use to evaluate whether an online entity — like a Hong Kong-based investment firm — genuinely exists. Think @bellingcat, but using company registries & copyright databases instead of Google Earth medium.com/@rsatter/busti…

Digital fronts can be extremely convincing. One of the undercover operations @jsrailton and I tracked put up a fake job ad to buttress the reputation of the fake Paris-based company they were using.

The job got *200* applicants.
medium.com/@rsatter/busti…

At the @AP, I have access to some of the world’s top journalists & can conscript them for site visits. But there’s plenty armchair OSINT experts can do too: OpenCorporates is one great resources, and “hacks” like getting a library card can give you access to massive databases.