Obama after P*ssin on Isreal, P*sses on Russia. Expells 35 Officials Seizes Compounds

[SunSpace]

https://www.us-cert.gov/sites/defaul...-2016-1229.pdf

"Both groups have historically targeted government organizations, think tanks, universities, and
corporations around the world. APT29 has been observed crafting targeted spearphishing
campaigns leveraging web links to a malicious dropper; once executed, the code delivers Remote
Access Tools (RATs) an
d evades detection using a range of techniques. APT28 is known for
leveraging domains that closely mimic those of targeted organizations and tricking potential
victims into entering legitimate credentials. APT28 actors relied heavily on shortened URLs in
their spearphishing email campaigns. Once APT28 and APT29 have access to victims, both
groups exfiltrate and analyze information to gain intelligence value. These groups use this
information to craft highly targeted spearphishing campaigns. These actors set up operational
infrastructure to obfuscate their source infrastructure, host domains and malware for targeting
organizations, establish command and control nodes, and harvest credentials and other valuable
information from their targets.

In summer 2015, an APT29 spearphishing campaign directed emails containing a malicious link
to over 1,000 recipients, including multiple U.S. Government victims. APT29 used legitimate domains, to include domains associated with U.S. organizations and educational institutions, to
host malware and send spearphishing emails. In the course of that campaign, APT29 successfully
compromised a U.S. political party. At least one targeted individual activated links to malware
hosted on operational infrastructure of opened attachments containing malware. APT29
delivered malware to the political party’s systems, established persistence, escalated privileges,
enumerated active directory accounts, and exfiltrated email from several accounts through
encrypted connections back through opera
tional infrastructure.
In spring 2016, APT28 compromised the same political party, again via targeted spearphishing.
This time, the spearphishing email tricked recipients into changing their passwords through a
fake webmail domain hosted on APT28 operational infrastructure. Using the harvested
credentials, APT28 was able to gain access and steal content, likely leading to the exfiltration of
information from multiple senior party members. The U.S. Government assesses that information was leaked to the press and publicly disclosed.

"Indicators of Compromise (IOCs)
IOCs
associated with RIS cyber actors are provided within the accompanying .csv and .stix files of JAR-16-20296.
Yara Signature
rule PAS_TOOL_PHP_WEB_KIT
{
meta:
description = "PAS TOOL PHP WEB KIT FOUND"
strings:
$php = " $base64decode = /
\='base'
\.\(\d+\*\d+\)\
.'_de'
\.'code'/
$strreplace = "(str_replace("
$md5 = ".substr(md5(strrev("
$gzinflate = "gzinflate"
$cookie = "_COOKIE"
$isset = "isset"
condition:
(filesize > 20KB and filesize < 22KB) and
#cookie == 2 and
#isset == 3 and
all of them
}
Actions to Take Using Indicators
DHS recommends that network administrators review the IP addresses, file hashes, and
Yara
signature provided and add the IPs to their watchlist to determine whether
malicious
activity has
been observed within their organizations. The review of network perimeter netflow or firewall
logs will assist in determining whether
your network
has experienced suspicious activity.
When reviewing network perimeter logs for the IP addresses, organizations may find numerous
instances of these IPs attempting to connect to their systems."

[SunSpace]

Putin's IPs:

167[.]114[.]35[.]70,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Canada.
185[.]12[.]46[.]178,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
46[.]102[.]152[.]132,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
50[.]2[.]64[.]140,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
69[.]12[.]73[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
92[.]240[.]253[.]181,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Slovakia.
94[.]102[.]63[.]139,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
95[.]183[.]50[.]23,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
95[.]215[.]44[.]115,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
128[.]199[.]108[.]0,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Singapore.
31[.]210[.]111[.]154,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Turkey.
88[.]198[.]25[.]92,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
185[.]82[.]202[.]102,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]152[.]205[.]159,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in United Kingdom.
85[.]204[.]74[.]91,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Lithuania.
104[.]36[.]83[.]204,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the United States.
188[.]42[.]254[.]26,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Luxembourg.
31[.]210[.]118[.]89,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Turkey.
153[.]92[.]126[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
185[.]82[.]202[.]45,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
213[.]202[.]214[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Germany.
93[.]115[.]38[.]141,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Bulgaria.
153[.]92[.]127[.]138,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
198[.]50[.]177[.]202,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Canada.
95[.]153[.]31[.]53,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Estonia.
103[.]41[.]177[.]77,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
104[.]207[.]130[.]126,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
131[.]72[.]138[.]33,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]148[.]111,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]148[.]227,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]149[.]223,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
191[.]96[.]66[.]15,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Venezuela.
213[.]179[.]207[.]166,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
87[.]236[.]211[.]182,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United Kingdom.
89[.]32[.]40[.]4,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
89[.]46[.]101[.]79,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Romania.
92[.]114[.]92[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
109[.]236[.]89[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
146[.]0[.]74[.]7,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
41[.]77[.]136[.]250,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Egypt.
5[.]149[.]254[.]114,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]9[.]32[.]230,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
81[.]171[.]56[.]203,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]149[.]97,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
131[.]72[.]138[.]99,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
151[.]80[.]220[.]34,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
164[.]132[.]102[.]184,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
217[.]23[.]12[.]10,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
92[.]114[.]92[.]107,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
185[.]82[.]202[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]1[.]82[.]130,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
5[.]199[.]171[.]58,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Lithuania.

And the list goes on.

https://www.us-cert.gov/sites/defaul...-16-20296A.csv

https://www.us-cert.gov/sites/defaul...-16-20296A.xml

https://www.us-cert.gov/security-pub...Cyber-Activity

You'd think Vladimir Putin would be able to afford unpredictability.

Sloppy work, Fancy Bears.





"Fancy Bear (also known as APT28, Pawn Storm, Sofacy Group, Sednit and STRONTIUM) is a cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. Security firms SecureWorks,[3] ThreatConnect,[4] and Fireeye's Mandiant[5] have also said the group is sponsored by the Russian government."

https://en.wikipedia.org/wiki/Fancy_Bear

[////]

a US president literally cutting off all diplomatic progress to the worlds most powerful countries because his party was exposed for rigging their primary election

can someone explain to me how that's any less corrupt than the third world governments we make fun of?

he is throwing geopolitical stability under the bus because his mafia party got exposed and they need a scapegoat. No other reason. No logic or rationalization even attempted.

[////]

Putin's IPs:

167[.]114[.]35[.]70,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Canada.
185[.]12[.]46[.]178,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
46[.]102[.]152[.]132,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
50[.]2[.]64[.]140,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
69[.]12[.]73[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
92[.]240[.]253[.]181,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Slovakia.
94[.]102[.]63[.]139,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
95[.]183[.]50[.]23,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
95[.]215[.]44[.]115,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
128[.]199[.]108[.]0,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Singapore.
31[.]210[.]111[.]154,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Turkey.
88[.]198[.]25[.]92,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
185[.]82[.]202[.]102,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]152[.]205[.]159,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in United Kingdom.
85[.]204[.]74[.]91,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Lithuania.
104[.]36[.]83[.]204,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the United States.
188[.]42[.]254[.]26,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Luxembourg.
31[.]210[.]118[.]89,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Turkey.
153[.]92[.]126[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
185[.]82[.]202[.]45,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
213[.]202[.]214[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Germany.
93[.]115[.]38[.]141,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Bulgaria.
153[.]92[.]127[.]138,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
198[.]50[.]177[.]202,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Canada.
95[.]153[.]31[.]53,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Estonia.
103[.]41[.]177[.]77,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
104[.]207[.]130[.]126,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
131[.]72[.]138[.]33,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]148[.]111,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]148[.]227,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]149[.]223,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
191[.]96[.]66[.]15,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Venezuela.
213[.]179[.]207[.]166,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
87[.]236[.]211[.]182,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United Kingdom.
89[.]32[.]40[.]4,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
89[.]46[.]101[.]79,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Romania.
92[.]114[.]92[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
109[.]236[.]89[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
146[.]0[.]74[.]7,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
41[.]77[.]136[.]250,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Egypt.
5[.]149[.]254[.]114,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]9[.]32[.]230,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
81[.]171[.]56[.]203,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]149[.]97,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
131[.]72[.]138[.]99,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
151[.]80[.]220[.]34,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
164[.]132[.]102[.]184,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
217[.]23[.]12[.]10,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
92[.]114[.]92[.]107,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
185[.]82[.]202[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]1[.]82[.]130,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
5[.]199[.]171[.]58,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Lithuania.

And the list goes on.

https://www.us-cert.gov/sites/defaul...-16-20296A.csv

https://www.us-cert.gov/sites/defaul...-16-20296A.xml

https://www.us-cert.gov/security-pub...Cyber-Activity

You'd think Vladimir Putin would be able to afford unpredictability.

Sloppy work, Fancy Bears.





"Fancy Bear (also known as APT28, Pawn Storm, Sofacy Group, Sednit and STRONTIUM) is a cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. Security firms SecureWorks,[3] ThreatConnect,[4] and Fireeye's Mandiant[5] have also said the group is sponsored by the Russian government."

https://en.wikipedia.org/wiki/Fancy_Bear

How can I use these to send him a thank you note for exposing our rigged political system?

You are a level dumber than the people who wanted to publicly hang Assange and Snowden.

Exposing criminals is not a crime.

[SunSpace]

How can I use these to send him a thank you note for exposing our rigged political system?

You are a level dumber than the people who wanted to publicly hang Assange and Snowden.

Exposing criminals is not a crime.

Word on the street is that the Fancy Bears hacked the Republicans, too, but sat on the info:

"Why did the White House act now?
The ultimate decision followed a CIA announcement this month, made in private to a group of top US senators, that the hacks were carried out with the express purpose of delivering the White House to Trump.
Their evidence -- which, again, has not been made public except through leaks to the press -- includes findings that Russian hackers breached, but did not make public information stolen from the accounts of Republicans, including House members and GOP non-profits, according to a former senior law enforcement official with direct knowledge of the hack investigation told CNN."

Such a move would make sense, since it would give the Russians target flexibility.

For example: If Trump didn't win the primary, but an anti-Putin Republican did, they could've done this the other way around.

Something doesn't sound right about that, however. Despite it being an option, I suspect the Russians were seeking something more...

Leverage.

There's no love lost between Clinton and Putin (they hate each other), so there has to be an edge to this somewhere.

I'd wager on that Vladimir Putin has his hands on some useful information he plans on releasing if House Republicans get out of line by not following "Trump."

Despite the sloppy work by the Fancy Bears, this would indeed be a brilliant move. He was thinking quite a few steps ahead.

This guy really took the U.S. to war, and I'm starting to wonder whether he won.

We'll see.

Oh, and by the way, I don't believe this has anything to do with "exposing criminals." Vladimir Putin is a criminal. All of these guys are; Trump, Hillary, Obama, you name it.

It's not about that.

This is about war. This is an attack by Russia with the intention of controlling their enemy. And it appears to have succeeded, with additional back-up information available to remove potential "obstacles."

http://edition.cnn.com/2016/12/30/po...ing-sanctions/

[////]

^ If Russia hacked the Republicans and exposed them for rigging elections and bribing journalists you know who would be angry? Republicans, at the Republican party.

This cultlike worship of hillary and barack is unique to the Democrats. That there was "backlash" against Russia instead of gratitude says it all.

[SunSpace]

^ If Russia hacked the Republicans and exposed them for rigging elections and bribing journalists you know who would be angry? Republicans, at the Republican party.

This cultlike worship of hillary and barack is unique to the Democrats. That there was "backlash" against Russia instead of gratitude says it all.

You're working under the assumption that this was done for the benefit of the public.

It's done so that Vladimir Putin can control the United States.

Look, we can both agree on that the elite are corrupt and evil all the way around; I don't dispute that. But let's not pretend like Putin is even thinking about protecting the interests of the average American here, either.

This is so that he wins his own war. Nothing more, nothing less.

And, considering Vladimir Putin's history (Google his path to power), this a tragic scenario for the world.

I'm not saying the Americans are any less evil than he is, but I'm also not going to feign happiness at what happened, especially when it threatens to derail the little progress the United States has made as a country.

[////]

Putin is going to control the united states because some hackers busted the democrats rigging elections and bribing journalists?

k you aren't brainwashed at all

Yes Russia has an intelligence agency like every other country in the world and they spy on other countries -- apparently liberals were the only people who didn't know this until now?

And they're "revealing" it to explain why their party shouldn't be disbanded for massive fraud?

[SunSpace]

Putin is going to control the united states because some hackers busted the democrats rigging elections and bribing journalists?

k you aren't brainwashed at all

Yes Russia has an intelligence agency like every other country in the world and they spy on other countries -- apparently liberals were the only people who didn't know this until now?

And they're "revealing" it to explain why their party shouldn't be disbanded for massive fraud?

If the plan is the way I'm thinking it is, Vladimir Putin established control over his enemy by first identifying damning information from both major political parties, and then selecting whom he would drown.

Now, Putin looks to have not only a friend, but friends in the White House (check the future Secretary of State).

The beauty of it all? The information Putin didn't release is still viable as an option in case Trump isn't supported by his own party.

Russia can pick and choose whom to drown and whom to save, once again.

That's thinking steps ahead and somewhat impressive despite the sloppy work.

[jaded]

Putin's IPs:

167[.]114[.]35[.]70,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Canada.
185[.]12[.]46[.]178,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
46[.]102[.]152[.]132,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
50[.]2[.]64[.]140,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
69[.]12[.]73[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States.
92[.]240[.]253[.]181,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Slovakia.
94[.]102[.]63[.]139,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
95[.]183[.]50[.]23,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Swaziland.
95[.]215[.]44[.]115,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
128[.]199[.]108[.]0,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Singapore.
31[.]210[.]111[.]154,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Turkey.
88[.]198[.]25[.]92,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
185[.]82[.]202[.]102,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]152[.]205[.]159,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in United Kingdom.
85[.]204[.]74[.]91,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Lithuania.
104[.]36[.]83[.]204,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the United States.
188[.]42[.]254[.]26,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Luxembourg.
31[.]210[.]118[.]89,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Turkey.
153[.]92[.]126[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
185[.]82[.]202[.]45,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
213[.]202[.]214[.]148,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Germany.
93[.]115[.]38[.]141,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Bulgaria.
153[.]92[.]127[.]138,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
198[.]50[.]177[.]202,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Canada.
95[.]153[.]31[.]53,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Estonia.
103[.]41[.]177[.]77,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
104[.]207[.]130[.]126,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
131[.]72[.]138[.]33,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]148[.]111,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]148[.]227,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
185[.]86[.]149[.]223,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Sweden.
191[.]96[.]66[.]15,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Venezuela.
213[.]179[.]207[.]166,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
87[.]236[.]211[.]182,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United Kingdom.
89[.]32[.]40[.]4,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
89[.]46[.]101[.]79,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Romania.
92[.]114[.]92[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
109[.]236[.]89[.]125,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
146[.]0[.]74[.]7,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
41[.]77[.]136[.]250,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Egypt.
5[.]149[.]254[.]114,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]9[.]32[.]230,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
81[.]171[.]56[.]203,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
185[.]86[.]149[.]97,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in Sweden.
131[.]72[.]138[.]99,IPV4ADDR,,IP_WATCHLIST,,,TLP:WHITE,This IP address is located in the Netherlands.
151[.]80[.]220[.]34,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
164[.]132[.]102[.]184,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in France.
217[.]23[.]12[.]10,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
92[.]114[.]92[.]107,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Italy.
185[.]82[.]202[.]174,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the Netherlands.
5[.]1[.]82[.]130,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Germany.
5[.]199[.]171[.]58,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in Lithuania.

And the list goes on.

https://www.us-cert.gov/sites/defaul...-16-20296A.csv

https://www.us-cert.gov/sites/defaul...-16-20296A.xml

https://www.us-cert.gov/security-pub...Cyber-Activity

You'd think Vladimir Putin would be able to afford unpredictability.

Sloppy work, Fancy Bears.





"Fancy Bear (also known as APT28, Pawn Storm, Sofacy Group, Sednit and STRONTIUM) is a cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. Security firms SecureWorks,[3] ThreatConnect,[4] and Fireeye's Mandiant[5] have also said the group is sponsored by the Russian government."

https://en.wikipedia.org/wiki/Fancy_Bear

Please stop pretending to be a techie and know what you are talking about...you obviously don't.

Your long post from the DHS (which I have twice linked up here) is a meaningless/moot document veiled under a disclaimer...and that list of IP's which YOU claimed as Putin's...are IP's from all over the world and are simply a watch-list for very unsophisticated phishing scams which we all have received. There is nothing to indicate that those are Putin's...in fact quite the contrary is evident.

FBI Director James Comey has already clearly stated in July that...

his investigators had no “direct evidence” that Hillary Clinton’s email account had been “successfully hacked,” : It very likely had been breached, but the intruders were far too skilled to leave evidence of their work.

http://www.nytimes.com/2016/07/07/us...perts-say.html

So do you think that now they all of the sudden got sloppy and left evidence? Just stop.