2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-05-25" ,
"extends_uuid" : "" ,
"info" : "OSINT - Tainted Leaks: Disinformation and Phishing With a Russian Nexus" ,
"publish_timestamp" : "1495712846" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1495712831" ,
"uuid" : "5926c399-62fc-4fa6-9d16-432802de0b81" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "tlp:white" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712711" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5926c3ad-dbdc-49ee-9045-4fc402de0b81" ,
"value" : "Documents stolen from a prominent journalist and critic of the Russian government were manipulated and then released as a \u00e2\u20ac\u0153leak\u00e2\u20ac\u009d to discredit domestic and foreign critics of the government. We call this technique \u00e2\u20ac\u0153tainted leaks.\u00e2\u20ac\u009d\r\nThe operation against the journalist led us to the discovery of a larger phishing operation, with over 200 unique targets spanning 39 countries (including members of 28 governments). The list includes a former Russian Prime Minister, members of cabinets from Europe and Eurasia, ambassadors, high ranking military officers, CEOs of energy companies, and members of civil society.\r\nAfter government targets, the second largest set (21%) are members of civil society including academics, activists, journalists, and representatives of non-governmental organizations.\r\nWe have no conclusive evidence that links these operations to a particular Russian government agency; however, there is clear overlap between our evidence and that presented by numerous industry and government reports concerning Russian-affiliated threat actors." ,
"Tag" : [
{
"colour" : "#00223b" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712711" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5926c3bb-8cc8-4335-8b40-4bda02de0b81" ,
"value" : "https://citizenlab.org/2017/05/tainted-leaks-disinformation-phish/" ,
"Tag" : [
{
"colour" : "#00223b" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712764" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5926c3fc-2cd0-4801-89b2-dd9502de0b81" ,
"value" : "id833.ga"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712765" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5926c3fd-8468-4986-abae-dd9502de0b81" ,
"value" : "89.40.181.119"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712765" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5926c3fd-ad64-4624-a45e-dd9502de0b81" ,
"value" : "id834.ga"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712766" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5926c3fe-25cc-4129-bdbb-dd9502de0b81" ,
"value" : "89.32.40.238"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712766" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5926c3fe-e788-4528-b1da-dd9502de0b81" ,
"value" : "id9954.gq"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712767" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5926c3ff-a718-47e3-9031-dd9502de0b81" ,
"value" : "80.255.12.237"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712767" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5926c3ff-3590-45a0-be99-dd9502de0b81" ,
"value" : "id4242.ga"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712768" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "5926c400-7b78-4846-b0e0-dd9502de0b81" ,
"value" : "mail-google-login.blogspot.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712769" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5926c401-dd88-4d8e-9ed3-dd9502de0b81" ,
"value" : "com-securitysettingpage.tk"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712804" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5926c424-6844-4771-8278-4f0e02de0b81" ,
"value" : "g.mail2017@yandex.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712804" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5926c424-1f74-4e74-8d88-4e1802de0b81" ,
"value" : "annaablony@mail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1495712805" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5926c425-ab60-4b01-93bc-4af802de0b81" ,
"value" : "myprimaryreger@gmail.com"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
