US government takes control of Internet domains used by SolarWinds hackers

Computer hacking

THE UNITED STATES GOVERNMENT has taken control of two Internet domains used last month in a large-scale phishing campaign by the same Russian-linked hacker group that was behind SolarWinds. The Department of Justice said on Tuesday it seized the two domains, theyardservice[.]com and worldhomeoutlet[.]com, on May 28, following a decision by a US court that authorized the action.

The large-scale attack was detected on May 25, and was delivered in over 3,000 emails sent from a compromised account belonging to the United States Agency for International Development (USAID). The compromised account was paired with the services of a legitimate email marketing company called Constant Contact. It was subsequently used to deliver phishing emails to the employees of over 150 organizations worldwide, most of them American.

The phishing emails featured an official USAID logo, beneath which was an embedded link to a purported “USAID Special Alert” titled “Donald Trump has published new documents on election fraud”. The link sent users to one of the two illicit subdomains, which infected victim machines with malware. The latter created a back door into infected computers, which allowed the hackers to maintain a constant presence in the compromised systems.

According to Microsoft Corporation, the hackers behind the phishing attack originated from the same group that orchestrated the infamous SolarWinds hack in 2020. The term refers to a large-scale breach of computer systems belonging to the United States federal government and to organizations such as the European Union and the North Atlantic Treaty Organization. The threat actor behind the attack is referred to by cybersecurity experts as APT29 or Nobelium, among other names.

Speaking on behalf of the US Department of Justice’s National Security Division, Assistant Attorney General John C. Demers said on Tuesday that the seizure of the two Internet domains demonstrated the Department’s “commitment to proactively disrupt hacking activity prior to the conclusion of a criminal investigation”.

Author: Joseph Fitsanakis | Date: 03 June 2021 | Permalink

News you may have missed #788

U-2 surveillance aircraftBy IAN ALLEN | intelNews.org |
►►US spy planes violated Israeli airspace in 1950s. American U-2 espionage planes repeatedly entered Israeli airspace in the 1950s for a series of secret spy missions, according to new information to be published by the Israel Air Force magazine next week, bringing to an end a decades-long mystery. At the time, Israel’s defense establishment was baffled by the entrance of high-flying crafts. For years, officials in IAF command disagreed on the identity of the mystery crafts, with some claiming that they were British Vickers-Valiants, and others saying they were American Vought F-8 Crusader planes, that had been stationed on a US aircraft carrier. According to documents to be published next week, it was the USSR that aided Israeli officials to expose the identity of the mystery planes, after a US U-2 espionage plane was shot down over Soviet soil.
►►US guard pleads guilty to espionage. A civilian guard at a new US consulate in China pleaded guilty on Thursday to attempting to sell Chinese security officials photographs and access to the compound so they could plant listening devices. According to a court proffer, Bryan Underwood had lost a significant amount of money in the stock market and hoped to make between $3 million and $5 million by supplying classified photos and information to China’s Ministry of State Security. Underwood, 32, appeared in federal court in Washington and pleaded guilty to one count of attempting to communicate national defense information to a foreign government.
►►CIA torture probe ends without any charges. The US Department of Justice has ended its investigation into the CIA’s interrogation program for terror detainees, without bringing charges. Attorney General Eric Holder said there was not enough evidence to “sustain a conviction beyond a reasonable doubt”. Jameel Jaffer, deputy legal director of the American Civil Liberties Union, said the investigation’s conclusions were a “nothing short of a scandal”. But CIA officials welcomed the decision. CIA Director David Petraeus thanked his staff for co-operating with the investigation. “As intelligence officers, our inclination is to look ahead to the challenges of the future rather than backwards at those of the past”, he said. No surprises here, surely.

Blackwater/Academi settles weapons-smuggling charges

Blackwater/Academi headquartersBy JOSEPH FITSANAKIS | intelNews.org |
In the eyes of many, the United States-based security firm formerly known as Blackwater is synonymous with ‘scandal’. Founded in 1997 by self-confessed CIA agent Erik Prince, the company was awarded hundreds of millions of dollars in non-competitive contract bids by the Bush administration, to provide wide-ranging security services in Iraq. But the company’s ‘shoot-first-ask-questions-later’ attitude resulted in numerous bloody incidents in the country, including the 2007 Nisur Square massacre, in which at least 14 Iraqi civilians were killed by trigger-happy Blackwater guards. In 2009, a frustrated US Department of State refused to renew the company’s governmental contracts, after which Blackwater terminated its partnership with the US government (or did it?). What is perhaps less known about the company, now renamed to Academi LLC, is that it has for years been the subject of several investigations by US authorities for a host of criminal offences, ranging from selling secret plans to foreign governments to illicit weapons trafficking. According to court documents unsealed yesterday at the United States District Court in New Bern, North Carolina, Academi has agreed to pay $7.5 million to settle some of these charges. Under the agreement, the company has owned up to 17 different criminal violations with which it was charged after a five-year multi-agency federal investigation led by the Department of Justice. The charges include possessing unregistered fully automatic weapons in the US, illegally exporting encrypted satellite-telephone hardware to Sudan, training foreign nationals without a license, giving classified documents to foreign governments, as well as selling weapons to the Kingdom of Jordan without US government authorization and then lying about it to US federal firearms officials. Read more of this post

News you may have missed #727

Jeffrey Paul DelisleBy IAN ALLEN | intelNews.org |
►►US government-authorized wiretaps increased in 2011. The US Justice Department sought 1,745 secret wiretapping warrants in 2011, an increase of 239 over 2010, according to correspondence sent to Congressional leaders and oversight committees. The secret warrants are governed under the Foreign Intelligence Surveillance Act (FISA) and are used in terrorist and espionage investigations by the FBI. The letter, dated April 30, 2012, also notes that the FBI issued 16,511 National Security Letters (NSLs) to obtain certain records and information in investigations. It further asserts that the requests were for investigations relating to 7,201 different US persons. The number of NSLs declined dramatically from 2010 when the FBI had sought 24,287.
►►Australia axes spy agency funding. Large budget cuts by the Australian Labour government, which is trying to engineer a federal budget surplus, are expected to affect funding for the country’s intelligence agencies. The six agencies of the Australian intelligence community have been given a collective budget of $81 million over four years, a figure that is $20.4 million lower than previous budgets. The government said that savings will be “redirected to support other national intelligence priorities”.
►►Canada spy case adjourned until June. The case of Jeffrey Delisle, a Halifax naval intelligence officer accused of espionage, has been adjourned until next month because his lawyer has not yet received all of the files in the case. Delisle is charged with communicating information to a foreign entity —probably Russia— that could harm national interests. Until 2010, Delisle worked for both Canada’s Chief of Defence Intelligence and at the Strategic Joint Staff, which oversees virtually every major aspect of the military’s domestic and international plans and operations.

News you may have missed #507

  • Pakistani media reveal name of CIA station chief. Mark Carlton, the purported CIA station chief in Islamabad, was named by a Pakistani newspaper and a private television news network over the weekend, the second holder of that post in less than a year to have his cover blown by the media.
  • How an immigrant from Taiwan came to spy for China. Well-researched article on Tai Shen Kuo, a Taiwanese-born American citizen who is serving time in an Arizona prison for spying on the US for China.
  • Domestic surveillance grew in US in 2010. The level of domestic US intelligence surveillance activity in 2010 increased from the year before, according to a new Justice Department report to Congress. Moreover, the secretive Foreign Intelligence Surveillance Court approved all 1,506 government requests to electronically monitor suspected “agents” of a foreign power or terrorists on US soil.

Cold War KGB agent Judith Coplon dies in Manhattan

Judith Coplon

Judith Coplon

By JOSEPH FITSANAKIS | intelNews.org |
Judith Coplon, an American Justice Department analyst who spied for the Soviet Union, and whose 1949 espionage trial became an international sensation, died last weekend in New York. When she was arrested by the FBI at age 27, Coplon worked as an analyst for the Justice Department’s Foreign Agents Registration Section, and was privy to counterintelligence reports issued daily by the Bureau. A few years prior to her March 1949 arrest, Coplon had begun an affair with Valentin A. Gubitchev, a married Soviet NKGB (forerunner of the KGB) officer stationed at the United Nations headquarters in New York. It is believed that Gubitchev recruited her and acted as her handler, meeting her regularly at various New York locations in order to obtain from her copies of Justice Department documents. In 1948, her role as an NKGB agent code-named ‘Sima’, was revealed through the National Security Agency’s VENONA project, which decoded wartime Soviet diplomatic cables that had been intercepted by US intelligence. Read more of this post

News you may have missed #403

Bookmark and Share

News you may have missed #343

  • Taliban leader H. Mehsud reportedly not dead. Last February US and Pakistani officials claimed a CIA airstrike had killed Hakimullah Mehsud, the leader of the largest faction of the Pakistani Taliban. But it now appears that Mehsud is alive and well.
  • Analysis: Operation MINCEMEAT and the ethics of spying. The New Yorker‘s Malcolm Gladwell on operation MINCEMEAT, a World War II British deception plan, which helped convince the German high command that the Allies planned to invade Greece and Sardinia in 1943, instead of Sicily.
  • US DoJ announces FISA court appointment. Judge Martin L.C. Feldman, of the Eastern District of Louisiana, has been appointed to a seven-year term on the Foreign Intelligence Surveillance (FISA) Court, which reviews (and invariably approves) government applications for counterintelligence surveillance and physical search under the Foreign Intelligence Surveillance Act.

Bookmark and Share

News you may have missed #339 (arrest edition!)

  • US couple arrested for spying for Cuba cooperating, say authorities. Admitted spies Walter and Gwendolyn Myers have met with US federal officials “50 to 60 times” to divulge details of their three decades of spying for Cuba, Justice Department officials said Tuesday. The couple pleaded guilty in November to working for the government of Caribbean island.
  • Indian diplomat arrested for spying for Pakistan. Madhuri Gupta, a second secretary at the Indian high commission in Islamabad, Pakistan, has been arrested and accused of passing on secrets to Pakistan’s ISI spy agency. Indian officials believe she may be part of a wider spy ring.
  • Former CIA station chief arrested in Virginia. Andrew M. Warren, the CIA’s Algiers station chief, who is accused of having drugged and raped two Algerian women at his official residence, has been arrested at a Norfolk, Virginia motel, after he failed to show up for a court hearing last week. It is unclear why he skipped the hearing and why he was staying at the motel in his hometown.

Bookmark and Share

News you may have missed #321 (CIA edition)

  • Uruguay ex-president sent to prison for 1973 coup. Declassified documents show that, at the time of the coup, Juan María Bordaberry told the US ambassador that “Uruguay’s democratic traditions and institutions […] were themselves the real threat to democracy”.
  • FSB ‘dropped the ball’ in Moscow metro bombings. Two Russian intelligence observers argue that Russia’s new strategy has shifted toward preventing coordinated actions by large groups of militants, which has come at the expense of taking measures to prevent individual suicide attacks, such as those of last Monday in Moscow.
  • Calls for expanded DoJ probe of FBI killing of Detroit imam. The US Justice Department is probing the killing of Detroit-area Islamic cleric Imam Luqman Ameen Abdullah, who was shot dead during an FBI raid shortly after being indicted on charges of conspiracy to commit federal crimes. The FBI said Abdullah was shot after he opened fire, but critics say he may have been targeted for assassination.

Bookmark and Share

Did Blackwater bribe Iraqi officials after 2007 shooting?

Blackwater logo

Blackwater logo

By JOSEPH FITSANAKIS | intelNews.org |
The US-based private security company Blackwater is under investigation by the US State Department, which suspects the corporation of having bribed Iraqi officials, in order to gain permission to continue to operate in Iraq, after the 2007 Nisour Square massacre. The company’s license to operate in Iraq was revoked by the Iraqi government on September 17, 2007, a day after trigger-happy Blackwater guards indiscriminately opened fire in Baghdad’s Nisour Square, killing 17 civilians, including women and children. But information obtained by The New York Times shows that the company hired well-connected Iraqi lawyers, and may have tried to buy off Iraqi lawmakers, in order to regain the right to operate on Iraqi soil. Read more of this post

News you may have missed #0196

  • Legal problems facing CIA are no laughing matter. They include two criminal investigations by the US Justice Department, persistent inquiries by the Senate Select Committee on Intelligence, as well as legal challenges from “war on terrorism” detainees.
  • Aussie computer networks “most certainly” spied on. The Australian federal government’s computer network has “almost certainly” been targeted by cyber-spies from other countries, according to attorney general Robert McClelland. “In some incidents nation states [are responsible]”, he told reporters.
  • US still considering extraditing Philippine spy. A judge has yet to rule on whether Michael Ray Aquino, a former Philippine National Police intelligence officer who served prison time for passing classified US government documents to the Philippine opposition, will be extradited to face murder charges back home. See here for more on this strange case.

Bookmark and Share

FBI ordered to release Cheney records in Valerie Plame probe

Valerie Plame

Valerie Plame

By IAN ALLEN | intelNews.org |
A US federal judge has ordered the FBI to release the transcript of an interview with former US vice-president Dick Cheney, conducted during an investigation into who leaked the identity of CIA operative Valerie Plame. Plame sought compensation after she was publicly named as a secret CIA operative. Along with her husband, former ambassador Joseph Wilson, she has fought a legal campaign, arguing that several Bush administration officials, including former Vice President Dick Cheney, and even President George W. Bush himself, were behind the leak of her CIA role. Cheney had a lengthy interview with prosecutors pursuing the leak case, but the transcripts of the exchange have so far remained secret on national security grounds. But US district Judge Emmet G. Sullivan said yesterday that there is no justification to withhold the entire interview since the FBI investigation has now concluded. Read more of this post

News you may have missed #0120

  • Film on America’s most famous whistleblower. A new documentary film, The Most Dangerous Man in America: Daniel Ellsberg and the Pentagon Papers, examines the life of Daniel Ellsberg, a US Pentagon employee who leaked documents to the American public in order to stop the Vietnam War. Ellsberg, 78, is still a pariah in the US defense community. He told the Associated Press that at a RAND (research arm of the Pentagon, where he used to work) reunion several years back, no one would shake his hand.
  • Retired US Air Force officer convicted in China spying case. Retired US Air Force officer James W. Fondren Jr. faces a maximum of 20 years behind bars, after being convicted of selling classified information on US-China military relations to a Chinese agent and lying to the FBI about it. The US Department of Justice accused Fondren, 62, of being part of a spy ring that operated on US soil under the supervision of Chinese government officials, whom Fondren supplied with classified documents for over three years, beginning in 2004.
  • Request to halt CIA probe “nonsense” says former agent. A controversial request by seven former heads of the CIA to end the inquiry into abuse of terrorism suspects held by the Agency is “nonsense”, says Bob Baer, a 20-year CIA caseworker in the Mid-East and former CIA station chief in Iraq. “To say let’s not look further into this because it could upset the agency is like saying let’s not look into Bernie Madoff because it could upset the financial sector”, said Baer.

Bookmark and Share

Panetta not about to resign, says US Senate intel panel head

Leon Panetta

Leon Panetta

By IAN ALLEN | intelNews.org |
Insider rumors have been circulating for at least a month now, that CIA Director Leon Panetta is frustrated and is considering resigning in February, after just one year at the post. On Tuesday, Senator Dianne Feinstein (D-CA), who chairs the Senate Select Committee on Intelligence, issued a bizarre statement saying that she spoke to Panetta on Monday, and that the Obama Administration appointee “has no intention of resigning, nor should he. I believe he has an important role to play”, added the Congresswoman. The CIA and the White House have both denied reports that Panetta, who last month publicly came out against a planned probe into CIA torture practices by the US Department of Justice, threatened to resign over the investigation. What is certain is that Senator Feinstein’s statement about his future will fuel, not squelch, whispers of Panetta’s impending departure, which are in fact getting stronger.

Bookmark and Share

%d bloggers like this: