In November 2019, an anonymous Twitter account called @m4lwatch posted some tweets. He says he found hacking software belonging to Sandworm - the hackers of the Russian secret service. And he draws a connection between Sandworm and NTC Vulkan - the company of the #VulkanFiles.
@m4lwatch writes about “Znatok”, a Russian name for someone who seems to know everything. "Znatok" is said to be used for cyber attacks. M4lwatch suspects that such targets could be people or embassies. Where he got this information from, he leaves open.
"Znatok" also appears in the #VulkanFiles - for example, a virtual computer is set up - a digital computer that does not need its own hardware. It is also called “Znatok”.
In a system called Scan from the #VulkanFiles, “Znatok” is also mentioned. Exactly this system is supposed to be approved by the military unit 74455 - by the GRU, by Sandworm.
So M4lwatch already knew some things about NTC Vulkan 2019. As part of this research, @derspiegel@paper_trail_m@ZDFfrontal contacted several people who follow the account or who are followed. Nobody has an answer as to who is behind “m4lwatch”.
2019 setzt ein anonymer Twitter-Account namens @m4lwatch einige Tweets ab. Er habe eine Hacking-Software gefunden, die zu Sandworm gehört - den Hackern des russischen Geheimdienstes. Und er stellt eine Verbindung her zu NTC Vulkan – der Firma aus den #VulkanFiles.
@m4lwatch schreibt über “Znatok”, ein russischer Name für jemanden, der scheinbar alles weiß. "Znatok” soll für Cyberangriffe genutzt werden. M4lwatch vermutet, Ziele könnten Personen oder Botschaften sein. Woher er diese Informationen hat, lässt er offen.
Auch in den #VulkanFiles kommt “Znatok” vor - zum Beispiel wird ein virtueller Rechner eingerichtet – ein digitaler Computer also, der ohne eigene Hardware auskommt. Auch er wird “Znatok” genannt.
The investigative team of the #VulkanFiles was able to identify several hundred Twitter accounts based on the clues in the documents. The investigation of @christo_buschek@flornrnd and Damian Leloup @lemondefr. A Thread.
The leads in the documents are often easy to miss. In one document, we found an Email address. It looks like many others, a first name, last name, a year. Next to it, we see a date.
A Twitter account with the same first name, last name, and year in its profile name tweets on that same date we saw in the documents.