The motive behind the Iranian Proud Boy operation is not transparent, but it's interesting that the email campaign and the video preyed on distinct fears from both sides of the partisan divide. 1/x
I'm not of the opinion that the emails were expected to keep a significant number of people away from the polls. I think it's more likely that they were designed to reinforce existing fears of voter intimidation. The focus here was probably Democrats. 2/x
The video began with the President's comments on the insecurity of mail-in voting before offering a dubious attempt to demonstrate a vulnerability in the mail-in voting process. This content appears to have been focused on fears from the other side of the aisle. 3/x
The goal of operations that prey on both sides is to broaden existing divides. By serving up something for everyone the sponsors of this operation undermine the whole democratic process. That's probably their primary aim. 4/x
• • •
Missing some Tweet in this thread? You can try to
force a refresh
2/ Meet @blar51, an incredibly talented cybersecurity practitioner you should know all know! Born and raised in Detroit, MI, Brandon has an associate’s degree in Computer Networking from Washtenaw Community College and works at Proofpoint.
3/ @blar51 was introduced to computers through friends in the year 2000 and developed his skillset at a computer trade school.
Today's indictments are a laundry list of Sandworm's misdeeds, some of which were never officially recognized until now. They are the most aggressive actor I have ever encountered and they have been my greatest concern for the upcoming election. 1/x fbi.gov/wanted/cyber/g…
In addition to the 2016 US election interference, Sandworm was responsible for:
-Intrusions into US critical infrastructure
-Ukraine blackouts and other infrastructure targeting
-NotPetya
-MacronLeaks
-Pyeongchang Olympics attack
The latter two are very important right now. 2/x
The Pyeongchang Olympics attack was the culmination of a lengthy harassment campaign following Russia's ban from the Games in South Korea. Attacks on Olympic orgs began within hours of the decision. DDOS. They sent an away team to hack orgs from right outside. 3/x
The report calls Konstanin Kliminik a Russian intelligence officer and suggests he may have been aware of the hack and leak operation. 2/x
Nice to see similar conclusions to our own show up in the report. In August 2016 we told Bloomberg that DCLeaks lacked the juice of Wikileaks to have the effects the GRU sought and so they pivoted. Reminder of the limitations of personas. Not as good as established sources. 3/x
We are releasing reporting on Ghostwriter, IO activity focused on Poland, Lithuania, and Latvia, which leverages false narratives and fabricated content often planted on compromised media sites. The activity is consistent with Russian interests. 1/x fireeye.com/content/dam/fi…
Ghostwriter began as early as 2017 and is still going strong, pushing Anti-NATO sentiment on the frontiers of the alliance. NATO soldiers hosted in these countries are portrayed as carjackers and blamed for desecrating cemetaries. Now they are portrayed as COVID-19 carriers. 2/x
Quotes, images, documents are fabricated to provide bona fides to Ghostwriter narratives in a manner similar to Secondary Infektion, though we have not found a link. For instance, a letter from the Secretary General of NATO claimed NATO was leaving Lithuania due to COVID. 3/x
The indictment of two Chinese nationals who carried out intrusions for the MSS is full of interesting insights on the state of Chinese cyber espionage. 1/x justice.gov/opa/press-rele…
First off, consider the efficiency of this capability. Two guys responsible for stealing hundreds of millions in intellectual property. And better yet, they're contractors, so limited overhead for the PRC! 2/x
Not the first time we've seen an extortion scheme from contractor types. APT41 has done something similar when seeking to monetize their access. Being allowed to carry out crime while under the protection of the state is just one of the benefits of this type of relationship. 3/x
Some coalescing thoughts on Iran's cyber capability. The first is that while cyberattack (disruption/destruction) is on the table, the most consequential capability may be cyber espionage. There will be cyber espionage against gov/mil targets as well as personnel of interest. 1/x
Iran, like others, has recently focused on moving upstream by compromising telecoms and travel. That way they can identify and track specific people. These operations put people in physical danger, especially in terrorism scenarios. 2/x fireeye.com/blog/threat-re…
Some of this activity has been enabled by DNS shenanigans, which was a leap forward for their operations. This report discusses those operations as well as some we attribute to SeaTurtle, another actor. 3/x fireeye.com/blog/threat-re…