Thread on the document #RealityWinner shared w the Intercept:
This is the doc that Reality sent bc Russians were trying to attack our democracy while US citizens sat around not knowing a damn thing. Its hard to read so Im typing it up below.
1/
This is the doc that Reality sent bc Russians were trying to attack our democracy while US citizens sat around not knowing a damn thing. Its hard to read so Im typing it up below.
1/
Also, here is the link to it with the actual report: documentcloud.org/documents/3766…
And remember, states did not know they were being targeted until after.
2/
And remember, states did not know they were being targeted until after.
2/
It is unknown if the GRU was able to successfully compromise any of the entities targeted as part of this campaign. While this ((redacted)) cyber espionage program utilized some techniques that were similar to other Russian GRU cyber operations units, ...cont'd👇
3/
3/
this activity demonstrated several characteristics that distinguish it from another major GRU spearfishing program known as ((redacted.))
There are indications that the threat actors may have similar efforts against other web-based email services including ...cont'd👇
4/
There are indications that the threat actors may have similar efforts against other web-based email services including ...cont'd👇
4/
Microsoft's live web mail, AOL & Mail.ru
Mimicked alerts from Google that were related to purported issues with the targeted users account, enticing the recipient to click on a malicious embedded link.
Email in the native language of the intended target.
5/
Mimicked alerts from Google that were related to purported issues with the targeted users account, enticing the recipient to click on a malicious embedded link.
Email in the native language of the intended target.
5/
Typical ruses included:
Lack of storage, password changes, and account verification requests related to the Stream web service.I
Actor controlled website that closely resembles Google webmail page.
6/
Lack of storage, password changes, and account verification requests related to the Stream web service.I
Actor controlled website that closely resembles Google webmail page.
6/
Once the victim Supply this information to the actor controlled website it would be related to a legitimate Google service, but only after the ((redacted)) actors had successfully obtained the victims password ...cont'd👇
7/
7/
(and if two-factor, phone number and Google verification code) associated with that specific email account.
The malicious hyperlinks provided were associated with either customized Bit.ly links, a domain shortening service, ...cont'd👇
8/
The malicious hyperlinks provided were associated with either customized Bit.ly links, a domain shortening service, ...cont'd👇
8/
or IP address, redirecting unwitting victim to a credential harvesting site where the ((redacted)) actors could conduct a man-in-the-middle attack.
9/
9/
If the victim had already enabled two-factor authentication (2FA), the actor controlled website would further prompt the victim to provide their phone number and the legitimate Google verification code that was sent to their phone.
10/
10/
• • •
Missing some Tweet in this thread? You can try to
force a refresh
