Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Jackie Singh Profile picture
@HackingButLegal
Jul 10, 2024 • 18 tweets • 6 min read • Read on X
I am reviewing this alleged hack of The Heritage Foundation.

I have identified very embarrassing data within this dataset. Why so many Chinese IP addresses? 🤔
The zipped file contains one single file:

"daily-signal_dev_database_new.sql"

This appears to be a combined set of exports from a SQL database. Here are the first lines Image
Because this is a combined export (likely from the command line) of various tables, the file is not readable by a typical SQL editor, and needs to be split into pieces to make it so.

I'd rather just turn it into CSV chunks to start cleaning up the dataset for further analysis
There are 215,000 lines or so in the WordPress Comments table. As you can see, comment_author_IP is available, which is broadly useful to get a sense of where people posting replies to the Heritage blog are coming from in the world.

Earliest date: 2008-01-04. Newest: 2022-11-09 Image
After creating a CSV chunk with only the WP comments table, now I can view columns and extract their content as needed. After extracting IP addresses from the author column, I can eliminate duplicates and work on analyzing their presumed geo origin, which is of interest to me Image
Dataset was a little dirty and a hassle to clean up.

Here are the 60K extracted IPs from the WP Comments table:

#HeritageFoundation defuse.ca/b/PTrmvlbs
Image
Sample geolocations from the first 100 IPs (these are sorted 'low to high', and many Asia-based netblocks start with the number 1) Image
Spies in the dataset

Here are the 69.5K email addresses present within the complete dataset:



🤔 235 .mil and .gov email addresses
🤔 95 .ru and .cn email addresses

#HeritageFoundationdefuse.ca/b/mLXCi0iXsGFj…
Linked below is a statistical breakdown of the domain names associated with all email addresses in the dataset.

Stacking and counting are basic analytical tools which can help analysts identify outliers.

defuse.ca/b/GMCj2uAfvELn…
Image
I have a script running to grab geolocation information and will tweet when it finishes.

Those working at big companies with access to certain commercial tools can do this more quickly than I can.
Because the original host took the file down, you can now find it here:

This is a 368 MB .zip file which uncompresses to a single 1.94 GB flat file.

SHA256: 3dcc258331d9139a654402d20b756b57ca17228aa9e2f80a4b6451b96c8eac70tan-medieval-hornet-252.mypinata.cloud/ipfs/QmVwiYsr4…
The hacker group claiming responsibility for this action has released new information on their Telegram channel. Image
Here is the list of Administrators.

defuse.ca/b/ely6s7iwqpLF…
BREAKING: SiegedSec claims to have officially disbanded.

#HeritageFoundation
Image
Image
Updated download link
@CloudsEdgeArt1 I am the first person covering this.
@loudmog cloudflare-ipfs.com/ipfs/QmVwiYsr4…

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Jackie Singh

Jackie Singh Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @HackingButLegal

Jackie Singh Profile picture
Jan 2
People in our country have a hard time facing inconvenient facts.

IMO, no leader is driving any effort that would change this outcome, as the People are kept ignorant, and have not demanded it. Believing otherwise is unwise, as there is no countering info to negate thus far.
Nothing on TV about this. Newspapers not accurately reflecting reality. Media is complicit.

America was correctly judged weak by fascist enemies, and attacked anew.

Vulnerabilities previously mapped—Now, the intelligence priorities of other nations will be carried out—for $$$.
It is crucial to face reality and stop with the hopium. This is where we are.

"You Are Here."

Ignoring one's location on a map does nothing to help orient oneself for future movement.
Read 5 tweets
Jackie Singh Profile picture
Dec 18, 2024
1/🧵

Q: Why do the GOP and Kremlin bots slander Kamala Harris and other Dems as "Marxist"?

A: I can explain! First, a little context:

Social Murder is a term used to describe unnatural deaths caused by social, political, or economic oppression, rather than direct violence. Image
2/ Social murder is committed by the elites against the poor, sometimes through omission rather than commission, & results in deaths that may seem natural, but were actually preventable.
3/ Think: Opposition to Obamacare, opposition to protective measures against climate change and infectious disease, new tariffs, low corporate taxes, austerity measures, lobbying against environmental and safety regulations...
Read 7 tweets
Jackie Singh Profile picture
Dec 12, 2024
1/ The promised laughs/tears of the day have arrived!

Buckle up y'all! Remember that incel loser who came at me the other day (image below, top left)? 👇🤠

Let's talk about it. Signals indicate the account belongs to Vladislav "Artem" Klyushin, a convicted hacker who was recently traded back to Moscow (Artem is a common diminutive for Vladislav).

He's wealthy and well-connected, is an associate of a GRU operative already indicted by the U.S. for interference in the 2016 election, runs cybersecurity firm "M-13" which does IT work for Putin's office, and was–and may still actively be–one of Putin's "Musketeers" (bodyguards, somewhat akin to the Secret Service) in the Federal Protective Service (FSO), which is reportedly assigned some level of responsibility over information warfare.

ARTEM_KLYUSHIN represents a high-level Kremlin influence actor who combines cyber and info warfare capabilities, financial operations, and direct policy influence through social media channels owned by his partners to achieve the goals of the man to whom he is loyal.

KEY FINDINGS

> Direct operational connection to GRU through indicted business partner Yermakov
> Demonstrated ability to predict and potentially influence major U.S. policy decisions
> Pre-arranged platform access on X
> Evidence of active, long-running coordination with Trump world + Musk
> Visible systematic strategy to degrade U.S. institutional safeguards

I apologize if images are a bit fuzzy, as the size limit on X is 10mb–I can also mirror these elsewhere later.Image
2/ Klyushin's cyber capabilities and social media operations likely stem from FSO training/connections rather than just GRU links. His relative ease of access to both Putin and elite western figures fits the operational pattern of FSO based on what is publicly known.

> FSO training/connection explains combination of technical and social capabilities
> Part of Putin's "Musketeers" system of trusted operators in strategic positions
> Activities mirror FSO's evolution from protection to Active Measures
> Uses FSO-style elite access patterns (ex. social events)
> Demonstrates FSO's characteristic focus on info warfare and institutional penetration

FSO officers being "elevated to ministerial posts and regional leadership positions" as described in the article below contextualizes Klyushin's focus on U.S. personnel appointments and institutional restructuring in his recent social media activity.Image
3/ Following his August 2024 release in a prisoner swap with the Kremlin in which he was exchanged for Evan Gershkovich, Paul Whelan, and others, he has publicly demonstrated a coordinated strategy of malicious targeting of U.S. institutions in collusion with domestic elected officials and unelected actors from the safety of his newly Russian digs.

Klyushin's post-release strategy shows three phases:

1. Electoral predictions and maps (establishing credibility, suggesting control)
2. Institutional restructuring "proposals" (targeting security apparatus)
3. "The Plan" narrative (coordinating multiple actors)

Each phase demonstrates increasing operational boldness–but who really needs a covert channel when you can publicly direct your men Donald Trump and Elon Musk from the safety of the platform and administration they purchased and own?

OPERATIONAL METHODS

Info Ops
> Multi-phase messaging strategy progressing from cryptic to explicit
> Uses accurate predictions to build credibility
> Coordinates timing of releases with official announcements
> Maintains parallel Russian/English messaging tracks

Platform Manipulation
> Direct communication channel with platform ownership
> Sophisticated understanding of engagement metrics
> Strategic use of reposting and amplification
> Extremely low engagement relative to bot/follower activity

Network Activation
> Direct tagging of key figures (realDonaldTrump, elonmusk)
> Interaction with Trump Jr. regarding nominations
> Signs of coordinated messaging with other platform actors
> Strategic amplification of specific proposalsImage
Read 8 tweets
Jackie Singh Profile picture
Dec 11, 2024
‼️🚨 These flyers have no creator attribution or symbology, and I doubt they are organic. They appear to be a continuation of the Kremlin‘s hybrid warfare tactics targeting NYC.

Goal: To obscure the next planned acts of violence as “stochastic”, or “random” attacks.

#Article5
Same gig as @LibsofTikTok: to give the public handy explanations when the Kremlin engages in terroristic acts on U.S. soil to influence Americans.

This is how they cover themselves and are able to continue engaging in “gray zone aggression” or “sub-threshold warfare”.
@libsoftiktok Go to Google News and type, “random attacks NYC”. A visiting computer science professor was “randomly” stabbed in the hand recently. They send messages constantly.

Speaking out against the Buscemi attacks got me targeted by a massive swarm of Russian bots for 3 solid days.
Read 17 tweets
Jackie Singh Profile picture
Dec 11, 2024
1/ Why do the fascists want to defund America's cyber defense agency?

Because they could implement something like what I describe in the section titled, "Technical Challenges and Solutions": hackingbutlegal.com/p/disinformati… x.com/HackingButLega…
2/ Why do they want to defund DHS's CISA and leave us vulnerable to cyber warfare?

Because DHS got the idea it could fight information warfare as well as cyber warfare, an idea which was immediately attacked by Putinists.

Tulsi Gabbard was very upset!!

en.wikipedia.org/wiki/Disinform…
3/ They've been running this play for years as part of their multi-pronged attack on the minds of the American people–The effort is intended to influence the world's most powerful nation away from its own best interests in collusion with domestic actors.

hackingbutlegal.com/p/cti-league-i…Image
Image
Read 7 tweets
Jackie Singh Profile picture
Nov 29, 2024
After the 2020 election, there were many investigations & calls for recounts led by GOP which were found to be baseless. Dems refusing to fight means they believe recounts won't change anything & will only lead to greater democratic distrust which undermines our electoral system.
Thing is, we don't even have a plan to stop bomb threats from affecting the next elections.

We can't even build one until we deeply understand what happened here–which may change our perception of the outcome.

Lawmakers avoiding this are shirking their responsibility to us.
We don't even know if vendors are required to submit their source code for review, like many government contractors handling sensitive data must do.

We don't know what happened to the last software which was stolen, that Fani Willis has evidence of.

We don't know much at all.
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(