Thread by @SlickRockWeb

I have seen plenty of sextorsion emails over the past couple of years .... but never a VOTEtorsion email. I guess this is one very unique use of a pilfered voter registration database. h/t @MajikaZulJin #Election2020

https://twitter.com/BJS_quire/status/1318567101368500226

Here is an example of a typical sextorsion spam email. None of it is true of course & the same with the VOTEtorsion spam email above. They can not know who you vote for since all voting is anonymous so you can ignore these. #infosec #phishing #infoOps #osint

Actually please contact us if you receive any VOTEtorsion email threatening you to vote a certain way or change party affliation. And try to save the original email for us if possible. Here is more good information from @Donie at @CNN #election2020

https://twitter.com/donie/status/1318726380646027264

So in the VOTEtorsion email we highlight above it says it was sent via saudi-re[.]com but is trying to spoof a Proud Boys email address. We don't have the original so I cant say for sure this is real. But if true, it would imply it was sent from a hacked website in Saudi Arabia

Moreover its a domain that this Saudi Arabian company has been using as a forwarding domain for yrs. The other know VOTEtorsion example so far comes from another likely hacked company in Estonia. This is some pretty serious obfuscation around the identity of the group behind this

So according to @RiskIQ data both the saudi-re[.]com & koolibri[.]ee domains, 2 purported domains used to send the VOTEtorsion emails, had DNS related changes to them within the past 24 hrs. Both are likely hacked websites & one suggests a compromised Sysadmin from Kuwait

So I just realized theres another even more insidious aspect 2 this VOTEtorsion email & that revolves around the phrase underlined in red. This serves to cast doubt & de-legitimize the election. For one thing, it is impossible to have access to the "entire" voting infrastructure

Looks like finally some technical details around the attribution to Iran. This is just breaking and we are reviewing the details now. reuters.com/article/us-usa…