ThreatConnect Blog

> My read of it Here's some reading material that you missed: https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-M… https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… http://www.threatgeek.com/2016/06/dnc_update.html https://www.threatconnect.com/guccifer-2-0-dnc-hack-fancy-bears/ > One must believe not only that Putin meddled, but that he saw Trump's victory as a sure thing and worth risking escalation over. Or that he wanted to delegitimize the Clinton presidency. > It seems likely that if someone like HRC or McCain had been in office, retaliatory military action by the US might have occurred. Nonsense. Increased economic sanctions are more effective against Russia's failing petroeconomy.

> Maybe I'm not up to date but what kind of evidence exactly? Could you give a source? Wired: "According to a number of top cybersecurity researchers, they're probably right." (https://www.wired.com/2016/07/heres-know-russia-dnc-hack/) Wired cites the following firms: Crowdstrike, Fidelis Cybersecurity, Mandiant... and a professor named Thomas Rid. Apparently Crowdstrike is the firm hired by the DNC specifically (https://www.washingtonpost.com/world/national-security/russian-governm… but there's more than one organization mentioned. New York Times: "American intelligence agencies have told the White House they now have “high confidence” that the Russian government was behind the theft of emails and documents from the Democratic National Committee, according to federal officials who have been briefed on the evidence." (http://www.nytimes.com/2016/07/27/us/politics/spy-agency-consensus-gro… Reuters: "U.S. intelligence officials told top congressional leaders a year ago that Russian hackers were attacking the Democratic Party, three sources familiar with the matter said on Thursday, but the lawmakers were unable to tell the targets about the hacking because the information was so secret." (http://www.reuters.com/article/us-usa-election-democrats-hack-idUSKCN1… The Daily Beast: "The researchers, at Arlington, Va.-based…

The second link has nothing to do with the DNC breach. It's the Ukrainian military disagreeing with Crowdstrike attributing a hack of Ukrainian software to Russia. And ThreatConnect also attributed it to Russia: https://threatconnect.com/blog/shiny-object-guccifer-2-0-and-the-dnc-b… >we assess Guccifer 2.0 most likely is a Russian denial and deception (D&D) effort that has been cast to sow doubt about the prevailing narrative of Russian perfidy

Several groups doubted the results such as Threat Connect and Ukraine's military: https://threatconnect.com/resource/webinar-guccifer-2-0-the-dnc-hack-a… https://www.voanews.com/a/crowdstrike-comey-russia-hack-dnc-clinton-tr…

ThreatConnect source: https://threatconnect.com/blog/building-out-protonmail-spoofed-infrast… The article glosses over attack details and mumbles about 'Russia is bad' for three-quarters of the text

Threatconnect did a decent amount of research into the attacks[0] for trying to figure out who did the attacks. There are other security researchers out there who come to similar conclusions. So either the government is bribing a bunch of security researchers (who doesn't want the scoop that the consensus is wrong?), the government executed a perfect false flag to blame Russia on something (why do this? It's not like having Russia as an enemy is useful for us), the analyses by these researchers are right, or something else. My money is on a decent amount of smart people all arriving somewhere near the truth. [0]: https://www.threatconnect.com/blog/guccifer-2-0-dnc-breach/

The attribution of the DNC hack to a Russian APT group has some backing from security professionals. Crowd Strike, based on analysis of the malware used, came to this conclusion (https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… This conclusion has been corroborated by Fidelis (http://www.threatgeek.com/2016/06/dnc_update.html) and Threat Connect (https://www.threatconnect.com/tapping-into-democratic-national-committ… It's early days, but the evidence is there. FYI, the Sony hack was very likely not committed by an insider (https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operat… DISCLAIMER: I worked with the team who did operation blockbuster.

Counterpoint: https://www.threatconnect.com/guccifer-2-0-dnc-breach/

If you get the paywall, I'd advise downloading the actual report from ThreatConnect it's far more detailed: http://www.threatconnect.com/camerashy/

Without having read the full PDF report [0], the summarized version [1] makes the allegations seem quite weak. It comes down, seemingly, to the fact that a PLA domain name appears in the malware. Maybe I'm missing something. [0] http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_C… [1] http://www.threatconnect.com/camerashy-resources/

>but I personally don't find affidavits on "The Smoking Gun" convincing Are you saying you think the affidavit is fake? Or that the info in the affidavit is not a strong indicator of Russia's involvement? > but it only shows that someone used (outdated!) malware that is available to any script kiddie, not state-level superhackerware. Stuxnet it ain't. Russia sometimes intentionally uses unsophisticated malware because it helps to make attribution harder.[1] > Destabilizing governments and throwing FUD is what the CIA does. Yes, but it's not what CrowdStrike, ThreatConnect, Secureworks, Fidelis, or FireEye do. Their business is to perform computer security investigations. Why would they jeopardize their business by publishing lies? > Perhaps [the CIA] are partisan Democrats, distracting from the content of the emails. Perhaps they are never-Trump Republicans. (a) Just because you're a partisan Democrat doesn't mean you do your job entirely wrong and fill your reports with lies. Same for never-Trump Republicans. (b) The CIA is not a homogeneous unit. There are people there of various political backgrounds. (c) Senator Richard Burr, who endorsed Trump[2], who was chosen by Trump to be a national security advisor[3], and who was accused of being "too close to Trump to lead an impartial investigation"[4], led a Senate committee that unanimously said the report was correct: > A three-year review by the Republican-led Senate Intelligence Committee unanimously found that…

AFAIK Jake Williams didn't get singled out because he only "wrote a blog post" about Shadow Brokers - it was because he was involved in a Twitter based dispute with Shadow Brokers. Somebody created a fake Twitter account and were sending all sorts of tweets to the Shadow Brokers, someone who was either in the IC or formerly in the IC. This is why the Shadow Brokers outed him in this post[0] > TheShadowBrokers is having special invitation message for “doctor” person theshadowbrokers is meeting on Twitter. “Doctor” person is writing ugly tweets to theshadowbrokers not unusual but “doctor” person is living in Hawaii and is sounding knowledgeable about theequationgroup. > Then “doctor” person is deleting ugly tweets, maybe too much drinking and tweeting? Is very strange, so theshadowbrokers is doing some digging. TheShadowBrokers is thinking “doctor” person is former EquationGroup developer who built many tools and hacked organization in China. > TheShadowBrokers is thinking “doctor” person is co-founder of new security company and is having much venture capital. It was easy for everyone on Twitter to figure out who he/she/they were referring to. I think this is important context - Shadow Brokers aren't just outing random operatives, they're flexing their access and abilities when being prompted to I also wonder if this wasn't part of a plan to bring the Shadow Brokers out of their shell a little - coax them into revealing a little more about themselves than the usual…

> They're buying servers or VPN connections on public providers. The notion of "strong attribution" in and of itself is basically impossible in the field of malware unless someone steps up and shows you the source. Those are things anyone can do. They're only doing a probabilistic analysis assuming no one else knows them, which makes many very large assumptions - like no one else wanting to fake Russian malware. Strong Attribution is definitely a difficult task and unless someone admits guilt, you'll have to rely on probabilities but the combined CrowdStrike, SecureWorks, and ThreatConnect reports give a fairly strong basis of where to place blame for the DNC servers. I'd imagine our intelligence agencies have their own methods of attribution that we won't learn of for a long time. As for Rob, this feels like a pretty balanced opinion: > The DNC hacks have strong evidence pointing to Russia. Not only does all the malware check out, but also other, harder to "false flag" bits, like active command-and-control servers. A serious operator could still false-flag this in theory, if only by bribing people in Russia, but nothing in the CIA dump hints at this. > The Sony hacks have weak evidence pointing to North Korea. One of the items was the use of the RawDisk driver, used both in malware attributed to North Korea and the Sony attacks. This was described as "flimsy" at the time []. The CIA dump [] demonstrates that indeed it's flimsy -- as apparently CIA malware also uses the…

With regard to your first part of your first contention, that Russia hacked the DNC, read the Crowdstrike report[1]. That will contain the most technical indicators publicly revealed. The second part, that Russia hacked John Podesta, is summarized mostly in these analyses.[2][3] Basically some actor used a single bitly account to create nearly 10,000 bitly links to sites that were obvious phishing domains for Google logins. Many of these links targeted people who only Russia would be interested in, for example, investigators of the MH17 shootdown, journalists and academics with a Russia focus, and organizations in the former Soviet states and Europe. Some of these domains were also linked to other campaigns known to be linked to APT28 or 29 (i.e., Russia). Your second contention, that Russia provided exfiltrated data to Wikileaks, seems to rely mostly on classified intelligence. All the public evidence is circumstantial. Up to you to believe it or not. [1]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… [2]: https://www.secureworks.com/research/threat-group-4127-targets-google-… [3]: https://www.threatconnect.com/blog/russia-hacks-bellingcat-mh17-invest…

I appreciate the sentiment that anyone can phish or password guess, but even a cursory glance at infosec reports shows there was an operation targeting the DNC that was far more sophisticated than a one man job. Firstly we know that that Podesta's account was targeted by a phishing email with a bit.ly link [0]. We have proof the bit.ly phishing link in this email was clicked twice in March [1], and his wikileaks dump stops two days after that. The bitly link uses the TTP of base64 encoded strings targeting a google account. We know DNC staffers whose information was leaked by DC Leaks, like Rinehart, were targeted the same way [2] and that the same infrastructure hosted the Rinehart and Podesta phishing pages, along with plenty of other phishing sites [3]. You can verify the bitly links if you like. We have reports long before Wikleaks released Podesta's information, and before DC leaks had released most of their information, that the same TTP of bitly links with base64 encoded strings that targeted Podesta, Rinehart etc. were targeting other high profile targets in Clinton's campaign [4] as well as Russians, Ukranians etc. [5]. According to security firms these were all using the same two bitly accounts. Those attacks were attributed to APT 28 by private companies long before Wikileaks released any Podesta information. We also have proof the same infrastructure that hosted dcleaks [6] hosted domains targeting Syrian human rights groups, Ukranians, Turks, Google…

The NSA has not, but more than a few private companies have investigated- Cloudstrike https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… Security firm Mandiant https://www.washingtonpost.com/world/national-security/cyber-researche… Fidelis Cybersecurity http://www.computerworld.com/article/3086314/security/russian-hackers-… SecureWorks Evidence https://www.secureworks.com/research/threat-group-4127-targets-hillary… Threatconnect https://www.threatconnect.com/blog/guccifer-2-all-roads-lead-russia/ FireEye https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-in…