{"id":370746,"date":"2018-07-25T06:36:29","date_gmt":"2018-07-25T05:36:29","guid":{"rendered":"http:\/\/rinf.com\/alt-news\/?p=370746"},"modified":"2018-07-25T06:39:07","modified_gmt":"2018-07-25T05:39:07","slug":"how-mueller-indictment-proves-ukraine-behind-dnc-hacks","status":"publish","type":"post","link":"http:\/\/rinf.com\/alt-news\/editorials\/how-mueller-indictment-proves-ukraine-behind-dnc-hacks\/","title":{"rendered":"How Mueller Indictment Prove’s Ukraine\u00a0Behind DNC Hacks"},"content":{"rendered":"
\"\"
Hackers caught!12<\/figcaption><\/figure>\n

Robert Mueller is on a roll. He\u2019s making all the right moves and going nowhere with his indictments. If you read the following carefully, you\u2019ll see the shell game he\u2019s playing from every angle. He\u2019s indicted the right group, just the wrong people.<\/p>\n

Let\u2019s start with what you know. Both of Mueller\u2019s indictments are based on the political witch-hunt Washington is on to destroy Russia and Donald Trump to support Ukraine.<\/p>\n

What you don\u2019t know is that either Robert Mueller decided he loves Russia and wants the facts to come out or he just made the biggest gaffe in judicial history. His choice of evidence leads directly to Ukrainian Intel. It doesn\u2019t go anywhere else and it offers a direct path to prosecute the Ukrainian government, hackers, and Information Operations groups.<\/p>\n

This means the US Congress and former\u00a0President\u00a0Obama\u2019s administration have been directing billions of dollars to support a country whose Intel units attack us. You don\u2019t have to agree with me. Mueller names the one group that makes Ukraine responsible for all of it.<\/p>\n

On February 16, 2018,\u00a0Mueller indicted 13 Russian nationals for trying to influence the 2016 election. The story of this group was first written about by Adrian Chen\u00a0as the\u00a0troll factory in St. Petersburg, Russia<\/a>. Mueller\u2019s original February indictment showcased a list of supposed crimes many of the indicted people were not there to commit, and that is according to his own sources.<\/p>\n

The problem for the Troll Farm indictment is according to legal and court records in St. Petersburg, it existed only as registered on paper. There were no bills, no payroll, no employees.\u00a0\u00a0It didn\u2019t exist in 2016 for it to be involved in the US election.<\/p>\n

Both indictments in US Federal Courts by Robert Mueller shows why both trials were nonstarters on evidence long before it becomes a problem for him. Mueller needed a case where no defendants would show up. The evidence the FBI has was fabricated by the group Shaltai Boltai that Mueller is\u00a0indicting. Their blog is where the only real evidence of the St Petersburg Troll Farm exists and Shaltai Boltai brags about creating it. This is the information Adrian Chen used for his story and the evidence used by Mueller in the February indictment.<\/p>\n

Mueller must know all this. He just never expected to get called out on it by the Russians he indicted showing up for their day in court.<\/p>\n

Mueller is going to have a huge problem using Shaltai Boltai to prove the Internet Research Agency even existed. From\u00a0a foundational article by Scott Humor at the Saker.is entitled\u00a0\u201cA Brief History of the Kremlin Trolls<\/a>,\u201d\u00a0the Internet Research Agency which\u00a0existed only on paper, ceased to exist in 2015. It was liquidated and merged with construction retail company called TEKA.\u201d\u00a0Humor lays the facts on the table and\u00a0left little need for any extra research on the matter.<\/p>\n

Humor notes the results of the court case in which an NGO pushed to get legal recognition of the troll farm as a working business in St Petersburg was thrown out by the courts. The woman they brought to sue for back wages could not even show the company existed.\u00a0\u00a0Why the Evidence Mueller has for the Indicting 13 Russian Nationals is Fraudulent<\/a><\/p>\n

Since the St Petersburg Troll Farm didn\u2019t exist in the same time and space as the 2016 election, what is Mueller proposing? Do the Russians time travel? Inter-dimensional portals? Is he some kind of meta-data truther like a few of his supporters in the private Intel Community?<\/p>\n

The article linked above laid the groundwork to look at the people inside\u00a0every<\/strong>\u00a0Fancy Bear hacker and influence group. It did so by falsifying Mueller\u2019s sources for these indictments.\u00a0\u00a0The source is the Russian hacker group Shaltai Boltai who are reportedly former GRU hackers convicted of treason that worked with the US and Ukraine Intel against Russia.<\/p>\n

I explored\u00a0Shaltai Boltai\u2019s confession to the FBI<\/a>\u00a0that\u00a0they were the DNC hackers<\/a>. Shaltai Boltai (aka Humpty Dumpty) tried to confess to the FBI after they were caught by the Russian government for treason. They hoped to get extradited to the USA. Remember that fact for the moment.<\/p>\n

Shaltai Boltai\u2019s Yevgeny Nikulin was interviewed by the FBI.\u00a0According to Disobedient Media\u2019s Adam Carter<\/a>\u00a0\u201cNikulin has stated in a letter, passed to his lawyer Martin Sadilek and reported by Moscow Times, that, after his arrest on October 5, 2016, he was visited by the FBI several times, the first of which was on 14-15 November, 2016.<\/p>\n

During those visits, Nikulin alleges that the FBI had asked him to confess to hacking John Podesta\u2019s emails. To quote the Newsweek article that reported it: the FBI visited him at least a couple of times, offering to drop the charges and grant him U.S. citizenship as well as cash and an apartment in the U.S. if the Russian national confessed to participating in the 2016\u00a0hacks of Clinton campaign<\/a>\u00a0chief\u00a0John Podesta\u2019s emails in July<\/a>.\u201d<\/p>\n

On\u00a0Friday\u00a0July 13th, According to\u00a0the New York Times story<\/a>, Robert Mueller indicted\u00a012\u00a0Russian military intelligence officers. They are accused of hacking the Democratic National Committee, the Clinton presidential campaign, and\u00a0the Democratic Congressional Campaign Committee. But according to the Times, \u201cthe indictment made no reference to\u00a0previous\u00a0\u00a0DNC hacks by a different Russian Intel Agency<\/a>. That agency was accused of spying, these 12 Russians indicted are accused of trying to influence the election.\u201d<\/p>\n

The Times, Washington Post, and every other news outlet knows Robert Mueller finally got his man. Even the CyberSec, InfoSec, and other Sec communities are supporting the indictments. In their eyes, Robert Mueller won one for the team.<\/p>\n

Over the last few days, I\u2019ve been involved in\u00a0Twitter\u00a0chats with respected CyberSec\/InfoSec people that ridiculed my ID of Fancy Bear because it didn\u2019t jibe with Robert Mueller. That\u2019s not something I\u2019d always call a bad thing but when they changed their\u00a0tune without realizing it, it made me wonder if they understood the information the way it was being presented.<\/p>\n

Marcy Wheeler @emptywheel linked an article at the Intercept \u201cWhat Mueller\u2019s Indictment Reveals About Russian and US Spycraft<\/a>.\u201d She made the point that she had seen this evidence and it was compelling.<\/p>\n

What new information was this cyber expert smitten with? According to Mueller\u2019s indictment of the 12 Russian Nationals, he has the email address that identified DNC hackers that made up the group of indicted Ruskie\u00a0phishermen.<\/p>\n

According to the Intercept article \u201cFor example, the spear-phishing emails that John Podesta, Clinton\u2019s campaign chair, and others received included links to the URL shortening service Bitly. The Bitly account that created these links was registered using the email address \u201cdirbinsaabol@mail.com.\u201d The attackers used that same email address to create an account on a provider where they leased a server, which they paid for using an \u201conline cryptocurrency service\u201d (based on the wording of some instructions quoted in the indictment, I think the service in question may be BitPay).\u201d<\/p>\n

If you know anything about that specific email dirbinsaabol@mail.com and the cryptocurrency service you know exactly how Mueller got that particular email address.\u00a0\u00a0The group of hackers the email address belongs to are notorious dirtbags and\u00a0didn\u2019t pay King Servers for server rentals<\/a>\u00a0they used for their exploits.<\/p>\n

The Russian company King Servers was understandably put-off and called the FBI to teach the little criminals a thing or two about crime on Russian soil. Mueller didn\u2019t get this information through his CyberSec community\u00a0ninja kung fu. The moral is if you choose to do bad things, make sure to pay your bills.<\/p>\n

So whose email was it? The email accounts belong to Shaltai Boltai who provided all the false information for the February indictment about the St. Petersburg Troll Farm. If you read the article linked to Mueller\u2019s evidence,\u00a0\u00a0Shaltai Boltai explicitly state their purpose was to hurt Russia. They made the documents, emails, and other evidence to create the Internet Research Company. Some of what\u2019s left on their blog entries are notable and undeniable.<\/p>\n

For evidence of the Troll factory existence, they built a trail with faked corporate emails from Russians that don\u2019t speak Russian well and\u00a0are supposed to be lawyers.<\/p>\n

All of this information is vital for properly identifying the hackers and influencers based on Mueller\u2019s indictment. The owners of that email address\u00a0are\u00a0Shaltai Boltai and except for one member are all in jail for treason against Russia. Shaltai Boltai was working against Russia and giving information to the US and Ukraine. That would be the best reason Mueller can\u2019t extradite them. The FBI\u2019s history of trying to work deals with them would be another good reason for leaving them in Russian jails.<\/p>\n

If you read the linked articles, it\u2019s clear the evidence so far\u00a0shows the\u00a012 Russians indicted by Mueller are there out of political expediency.\u00a0\u00a0According to the NYT he\u2019 s going after election influence and hacking. His indictment lists Fancy Bear specific malware and tools like X-Agent and supposedly\u00a0the hackers that used them.<\/p>\n

Marcy Wheeler gave her complete support of Mueller\u2019s attributions on her blog. She wrote nothing contrary to it even when Mueller unabashedly includes Fancy Bear signature tools like X-Agent. This is a bit different from her opinion in January 2017 after the ODNI Report.<\/p>\n

\u201cThe FBI report is based solely on Crowdstrike\u2019s evidence<\/a>\u00a0which has become a laughing stock across the cybersecurity industry. Cybersecurity professionals are standing up saying how laughable Dimitri Alperovitch\u2019s information is. For there to be any evidence of a hack, the DNI report has to use the FBI report and Crowdstrike\u2019s evidence. This includes the tool X-Agent.<\/p>\n

X-Agent was a key proof for Crowdstrike. In the NPR interview with Judy Woodruff, Crowdstrike\u2019s CTO, Dimitri Alperovitch says the use of X-agent shows guilt as clearly as DNA results. This proof, according to him is unique to a single hacker group. Crowdstrike labeled this hacker group \u201cFancy Bear.\u201d Just as important is the timeline it was used in.<\/p>\n

According to Marcy Wheeler, Crowdstrike\u2019s story of a Russian hacker falls apart on this point. Part of the problem is that Alperovitch stated his final undeniable and overwhelming proof was that it was used\u00a0to target Ukrainian artillerymen throughout 2014<\/a>.\u00a0\u00a0She argues given that timeline for the GRU, X-Agent had to be in development at least 6 months BEFORE Victor Yanukovych was ousted in a coup. Ukraine and Russia were on friendly terms.<\/p>\n

Further, citing Jeffery Carr, X-Agent doesn\u2019t have anywhere near the functionality that Crowdstrike claims it does. Carr goes on further to say two other entities have access to X-Agent which Crowdstrike presents as unique. The first is Crowdstrike itself. The second is the Ukrainian hacking group RUH8 which self-identifies with Pravy Sektor.\u201d<\/p>\n

I feel Marcy Wheeler\u2019s position change on Fancy Bear signature items is very refreshing. I think she should really commit to reading @emptywheel more thoroughly. I couldn\u2019t be more happy about Robert Mueller hanging his hat on the email address and Fancy Bear tools.<\/p>\n

The reason I\u2019m thrilled about it is the same people who want to argue about Fancy Bear\u2019s attribution have clearly identified the Russian GRU and FSB criminal hackers.\u00a0\u00a0They are called Shaltai Boltai aka Humpty Dumpty aka Anonymous International as the culprits. Good show!<\/p>\n

The\u201dit\u201d I\u2019m thrilled with is Shaltai Boltai\u2019s exclusivity in the indictment. Every journalist and politico should jump on this and understand why they point directly to Ukraine.<\/p>\n

I believe if any of the named and unnamed CyberSec experts spent a little more time researching instead of tweeting, they would have seen this at some point during the last 2 years. Along with Mueller, they would also see choosing the evidence he did to work with, Mueller just hung THE DNC HACKS, SURKOV HACKS, PODESTA HACKS, GERMAN PARLIAMENT HACKS, TV 5 MONDE HACKS, NATO HACKS, AND REPUBLICAN HACKS on UKRAINE\u2019s ultranationalist Intel.<\/p>\n

RUH8 credits \u201cmostly CyberHunta\u201d with<\/a>\u00a0the Surkov e-mail theft (Why this is a theft, not a hack is discussed in Fancy Bear ID article) and says it was not the result of a spear-phishing scam but rather what he describes cryptically as \u201cspecial software.\u201d He claims the malware allowed CyberHunta not only to retrieve Surkov\u2019s e-mail but to \u201ctake the entire [Russian] presidential administration system under their control, and they gathered information right from the computers.\u201d<\/p>\n

BOOM!<\/p>\n

Everything going forward is premised on identifying Fancy Bear whose actions, tools, blogs, interviews, and indictments are in the above and below linked articles. Below we have their confessions to Fancy Bear hacks made to Ukrainian Intelligence, the Atlantic Council, and Bellingcat. We have them announcing they used the same methods for the Podesta email hack.<\/p>\n

Since we have a basis for falsifying Fancy Bear in place, the hackers were identified in part through\u00a0their qualified confessions to hacks Fancy Bear did<\/a>. This was supported by RFE\/RL, the Atlantic Council, and journalists that identified their association with Fancy Bear through an alternate name they were using.<\/p>\n

If you are reading the support material in the linked articles, it\u2019s clear that the sources are kept in context. Most are friendly to Ukraine and even Mueller investigation. In these instances, the facts mattered and they reported them.<\/p>\n

Sources I used to identify Fancy Bear include Ukrainian Intel, Bellingcat, the Atlantic Council, the hackers, the Russian traitors, Dimitry Alperovich, Crowdstrike, the SBU, RFE\/RL, Newsweek, Jeffery Carr, a slew of other MSM news sources, of course, @Emptywheel\u2019s Marcy Wheeler.<\/p>\n

Ukraine\u2019s Fancy Bear Unit started by supplying information about the situations in Ukraine and Syria. The information is the basis for a lot of Bellingcat\u2019s identifications. Ukraine\u2019s Intel provides evidence for the reports and articles they fabricate for the Atlantic Council and NATO. The Fancy Bear Intel unit supports ISIS and allied groups in Ukraine and Syria.<\/p>\n

According to Ukrainian Intelligence Hackers (now identified as Fancy Bear), even\u00a0Bellingcat is clearly a part of Ukrainian Intelligence<\/a>.<\/p>\n