DoJ Issues an Arrest Warrant of Jose Zarate, Steinle’s Killer

The Department of Justice issued an arrest warrant in the U.S. District Court in Texas for Jose Garcia Zarate for a supervised release violation.

Image result for jose zarate photo

His original criminal complaint filed in May of 2016, shows that Zarate’s criminal history in the United States goes back to 1993.

San Francisco owns this, meanwhile:

The San Francisco Superior Court knew this case would be such a big event, they issued a MEDIA GUIDE.

Zarate was acquitted of first and second degree murder, involuntary manslaughter and found not guilty of an assault with a weapon. He was only guilty of possessing a firearm by a felon.

Now under the Department of Justice, ICE will take custody of of Mr. Garcia where U.S. Marshals will transport him under the arrest warrant pursuant to the Western District of Texas. This arrest warrant was originally issued in 2015 and has been amended since that time with additional charges.

Image result for kate steinle photo

While we grieve for Kate and her family:

The timeline since he was acquitted for the murder of Kate Steinle:

SAN FRANCISCO — Latest on the trial of a Mexican man in a killing on a San Francisco pier (all times local):

1:45 p.m.

A federal judge in Texas has unsealed an arrest warrant for the Mexican man found not guilty of killing a woman on a San Francisco pier.

U.S. District Judge Alia Moses unsealed the warrant for Jose Ines Garcia Zarate on Friday. It was issued in July 2015 after Garcia Zarate was arrested in the slaying of Kate Steinle days earlier on a San Francisco pier.

Garcia Zarate had been convicted in federal court of illegally re-entering the U.S. and was on supervised release at the time of Steinle’s slaying. Federal officials allege the Steinle shooting violated the terms of his supervision.

The Justice Department has said it will look at possible illegal re-entry and/or violation of supervised release charges against Garcia Zarate after jurors in San Francisco acquitted him of murder in Steinle’s shooting.

12:15 p.m.

The office of Mayor Ed Lee issued a statement that San Francisco is and always will be a “Sanctuary City” as thousands of Twitter users bashed a verdict finding a Mexican man not guilty of killing a woman.

Lee did not elaborate in the statement issued Friday.

Two former city supervisors also defended San Francisco’s sanctuary policy, which prohibits local cooperation with federal immigration authorities.

California state Sen. Scott Wiener says that public safety is improved when people who are in the country illegally can go to police without fear of deportation.

David Campos, who now chairs the San Francisco Democratic Party, said the jury system worked.

Jose Ines Garcia Zarate was released from jail despite a federal immigration detainer request in 2015 and months later, he shot and killed Kate Steinle on a city pier.

9:30 a.m.

The Justice Department is considering bringing federal charges against a Mexican man found not guilty of killing a woman on a San Francisco pier.

Department spokeswoman Sarah Isgur Flores tells Fox News that the U.S. Attorney General’s Office is looking at every option to prosecute Jose Ines Garcia Zarate “to the fullest extent available under the law because.”

A Department of Justice official says federal prosecutors will look at possible illegal re-entry and/or violation of supervised release charges.

A San Francisco jury on Thursday found Garcia Zarate not guilty of killing Kate Steinle in a case that touched off a national immigration debate.

Deport Those Chinese Operatives Now

Have you read the newly released book titled ‘Bully of Asia’ by Steven W. Mosher? China is the single largest threat to global stability and Russia and Iran in second and third place.

Have you heard of the Thucydides Trap? China is an ascending power and just who is paying attention? Have you studied the fact that China is a major enabler of North Korea’s aggression behavior including the most recent launch of the intercontinental ballistic missile?

China is a thief. China has dispatched operatives throughout the West under the guise of cultural exchanges, students, temporary workers and journalists. It is all about espionage and cyberwar.

Image result for china spies photo

Hey State Department and DHS, get these operatives outta here. By the way, are there any sanctions on China with regard to PLA Unit 61398?

photo

Have you wondered what happened to that Obama Asia Pivot that he announced in 2011? The United States needs to pivot again and now.

Why?

This Beijing-Linked Billionaire Is Funding Policy Research at Washington’s Most Influential Institutions

The Chinese Communist Party is quietly reshaping public opinion and policy abroad.

FP: The Johns Hopkins University’s School of Advanced International Studies (SAIS), located just a short walk from Dupont Circle in Washington, D.C., is one of the top international relations schools in the United States. Its graduates feed into a variety of government agencies, from the State Department to the CIA, and the military. Its China studies program is especially well known; many graduates come away with expert knowledge of the language, culture, and politics of the United States’ most important strategic competitor.

In August, SAIS announced a new endowed professorship in the China Studies department as well as a new research project called the Pacific Community Initiative, which aims to examine “what China’s broader role in Asia and the world means for its neighbors and partners.”

What the SAIS press release did not say is that the money for the new initiatives came in part from the China-United States Exchange Foundation (CUSEF), a Hong Kong-based nonprofit. CUSEF is a registered foreign agent bankrolled by a high-ranking Chinese government official with close ties to a sprawling Chinese Communist Party apparatus that handles influence operations abroad, known as the “united front.”

The China-U.S. Exchange Foundation’s partnership with a premier U.S. academic institution comes amid a Chinese Communist Party push to strengthen its influence over policy debate around the globe. The Chinese government has sought to repress ideas it doesn’t like and to amplify those it does, and its efforts have met with growing success.

Even as Washington is embroiled in a debate over Russian influence in U.S. elections, it’s China that has proved adept at inserting itself in American politics.

“The Chinese approach to influence operation is a bit different than the Russian one,” said Peter Mattis, a fellow at the Jamestown Foundation. “The Russian one is much more about an operational objective and they work backward from that objective, saying, ‘How do we achieve that?’” But on the Chinese side, Mattis said, “they focus on relationships — and not on the relationships having specific takeaway value, but that someday, some way, those relationships might become valuable.”

The Chinese seek a kind of “ecological change,” he explained. “If they cultivate enough people in the right places, they start to change the debate without having to directly inject their own voice.”

The China-U.S. Exchange Foundation was founded in 2008 by Tung Chee-hwa, a Hong Kong shipping magnate who later served as the chief executive of the former British colony, where he championed the benefits of close ties to Beijing. Tung’s Hong Kong-based nonprofit conducts academic and professional exchanges, bringing U.S. journalists, scholars, and political and military leaders to mainland China. It also has funded research projects at numerous U.S. institutions, including the Brookings Institution, the Center for Strategic and International Studies, the Atlantic Council, the Center for American Progress, the East-West Institute, the Carter Center, and the Carnegie Endowment for Peace.

Tung’s foundation’s ties to the united front are indirect, but important. Tung currently serves as the vice chairman of one of the united front’s most important entities — the so-called Chinese People’s Political Consultative Conference, which is one of China’s two rubber-stamp assemblies.

The body is one of Beijing’s most crucial tentacles for extending influence.

In its newest project with SAIS, the foundation describes the Pacific Community Initiative as a “joint research project.” David Lampton, director of the university’s China Studies Program, said in an August press release that the new professor “will also be responsible for running our Pacific Community Initiative and work closely with the China-U.S. Exchange Foundation in Hong Kong.”

Lampton also confirmed that CUSEF funded the new programs. “Both the Initiative and the Professorship were made possible through the support of the China-U.S. Exchange Foundation,” he said in an emailed statement to Foreign Policy.

But he denied that CUSEF had attached any intellectual strings to its funding.

“There are absolutely no conditions or limitations imposed upon the Pacific Community Initiative or our faculty members by reason of a gift or otherwise,” Lampton told FP. “We have full confidence in the academic integrity and independence of these endeavors.”

CUSEF denies it acts as a vehicle for Beijing’s ideological agenda or has “any connections” to the united front. “We do not aim to promote or support the policies of any one government,” wrote a spokesperson for the foundation in an email.

This isn’t the first time SAIS and the foundation have worked together; they co-sponsored a conference on China’s economy in Hong Kong in March 2016, according to the school’s website. But a professorship and a major research project offer an opportunity for broader reach — the kind of global influence that Chinese President Xi Jinping has made a centerpiece of his policies. In October, at the meeting of the Communist Party that sets the national agenda for the next five years, Xi called for an expansion of the party’s overseas influence work, referring to the united front as a “magic weapon” of party power.

That quest to shape the global view of China isn’t the same thing as soft power, said James Leibold, a professor at La Trobe University in Melbourne who researches Chinese influence in Australia, where Beijing’s recent influence operations have sparked a national controversy.

China is an authoritarian state where the Communist Party rules with an iron fist, Leibold said — and that is what Beijing is trying to export.

“What we’re talking about here is not Chinese influence per se, but the influence of the Chinese Communist Party.”

In a joint project like the one at SAIS, that influence can be subtle rather than being heavy-handed, said Jamestown’s Mattis. “It’s the ability to privilege certain views over others, to create a platform for someone to speak,” he said. “When you have a role in selecting the platform and generating what I presume they hope are some of the bigger reports on U.S.-China relations in the next few years, that’s important.”

One goal of the joint research project is, in fact, to “yield a white paper to be submitted for endorsement by both the U.S. and Chinese governments,” a CUSEF spokesperson wrote in an emailed statement to FP.

While CUSEF representatives stress that it is not an agent of the Chinese Communist Party, the foundation has cooperated on projects with the the People’s Liberation Army and uses the same Washington public relations firm that the Chinese Embassy does.

One of those PLA projects is the Sanya Initiative, an exchange program that brings together U.S. and Chinese former high-ranking military leaders. On the Chinese side, the Sanya Initiative is led by a bureau of the PLA that engages in political warfare and influence operations, according to Mark Stokes, executive director of the Project 2049 Institute.

Sometimes the results of such high-level exchanges aren’t subtle. In February 2008, PLA participants in the Sanya Initiative asked their U.S. counterparts to persuade the Pentagon to delay publishing a forthcoming report about China’s military buildup, according to a segment excised from the 2011 annual report of the congressional U.S.-China Economic and Security Review Commission.

The U.S. members complied, though their request was not successful.

Exchanges and partnerships are not CUSEF’s only initiatives. As a registered foreign agent, in 2016 it spent just under $668,000 on lobbying, hiring the Podesta Group and other firms to lobby Congress on the topic of “China-U.S. relations.” The foundation has spent $510,000 on lobbying to date in 2017.

CUSEF also keeps on retainer the consulting and public relations firm BLJ Worldwide LTD, the same firm the Chinese Embassy in the United States uses. According to FARA filings, CUSEF currently pays the firm $29,700 a month to promote the foundation’s work and run a pro-Beijing website called China US Focus.

Whether through websites, partnerships, or endowments, China has learned to wrap its message in a palatable wrapper of U.S. academics and intellectuals, according to Mattis.

“Who better to influence Americans than other Americans?” he said.

3 Chinese Nationals Charged with Hacking, Stealing Intellectual Property

Indictment found here.

Wonder if President Trump has called President Xi….The U.S. Treasury should at least sanction Guangzhou Bo Yu Information Technology Company Limited….

Pittsburgh:

The Justice Department on Monday unsealed an indictment against three Chinese nationals in connection with cyberhacks and the alleged theft of intellectual property of three companies, according to US officials briefed on the investigation.

But the Trump administration is stopping short of publicly confronting the Chinese government about its role in the breach. The hacks occurred during both the Obama and Trump administrations.
The charges being brought in Pittsburgh allege that the hackers stole intellectual property from several companies, including Trimble, a maker of navigation systems; Siemens, a German technology company with major operations in the US; and Moody’s Analytics.
US investigators have concluded that the three charged by the US attorney in Pittsburgh were working for a Chinese intelligence contractor, the sources briefed on the investigation say. But missing from court documents filed in the case is any explicit mention that the thefts were state-sponsored.
A 2015 deal between then-President Barack Obama and Chinese President Xi Jinping prohibits the US and China from stealing intellectual property for the purpose of giving advantage to domestic companies.
In recent months some US intelligence agencies have concluded that China is breaking the agreement, sources briefed on the matter say. But there’s debate among intelligence officials about whether there’s sufficient evidence to publicly reveal the Chinese government’s role in the infractions, these people say.
Obama administration officials had touted the Obama-Xi agreement, as well as 2014 Justice Department charges against members of the Chinese People’s Liberation Army for commercial espionage, for reducing some of the Chinese cyberactivity against companies in the US.
But the 2015 Obama-Xi deal was met with skepticism inside the US agencies whose job it is to guard against Chinese cyberactivity targeting US companies. Some now say there was only a brief drop in the number of cyberspying incidents, if at all.
In the waning months of the Obama administration, intelligence officials briefed senior White House officials on information showing that the Chinese cyberattacks were back to levels previously seen, sources familiar with the matter told CNN. Early in the Trump administration, US intelligence officials briefed senior officials, including the President and vice president, as well as advisers Jared Kushner and Steve Bannon. More here.
***

Acting U.S. Attorney for Western Pennsylvania Soo C. Song charged Wu Yingzhuo, Dong Hao and Xia Lei with conspiracy to commit computer fraud and abuse, conspiracy to steal trade secrets, wire fraud and identity theft.

The most serious charge, wire fraud, carries a sentence of up 20 years in federal prison. Each conspiracy charge has a possible sentence of up to 10 years and the identity theft carries a sentence of up to two years.

The indictment alleged that Wu, Dong and Xia worked with Guangzhou Bo Yu Information Technology Company Limited, a Chinese cybersecurity firm in Guangzhou, but used their skills to launch attacks on corporations in the U.S.

Between 2011 and May 2017, the trio stole files containing documents and data pertaining to a new technology under development by Trimble, along with employee usernames and passwords and 407 gigabytes of proprietary data concerning Siemens’ energy, technology and transportation efforts, according to the indictment. The trio gained access to the internal email server at Moody’s Analytics and forwarded all emails sent to an “influential economist” working for the firm, the indictment stated. Those emails contained proprietary and confidential economic analyses, findings and opinions. The economist was not named in the indictment.

A Siemens spokesperson said that the company “rigorously” monitors and protects its infrastructure and continually detects and hunts for breaches. The company did not comment on the alleged breach by the Chinese hackers and declined to comment on internal security measures.

Michael Adler, a spokesman for Moody’s Analytics, said that to the company’s knowledge no confidential consumer data or other personal employee information was exposed in the alleged hack.

“We take information security very seriously and continuously review and enhance our cybersecurity defenses to safeguard the integrity of our data and systems,” Adler wrote in an email to the Tribune-Review.

Trimble, in a statement sent to the Trib, wrote that no client data was breached. The company concluded that the attack had no meaningful impact on its business.

Song, however, said the loss to the companies targeted was considerable.

“The fruit of these cyber intrusions and exfiltration of data represent a staggering amount of dollars and hours lost to the companies,” Song said.

Wu, Dong and Xia used “spearphish” emails to gain access to computers, spread malware to infect networks and covered their tracks by exploiting other computers known as “hop points.”

Hop points allow users to hide their identities and locations by routing themselves through third-party computer networks.

“But there were missteps that led our investigators right to them,” said FBI Special Agent in Charge Bob Johnson of the Pittsburgh office.

Johnson would not elaborate on the missteps the accused hackers took, claiming doing so could jeopardize future investigations.

The U.S. Attorney’s Office led the investigation and was assisted by the FBI’s Pittsburgh Division, the Navy Criminal Investigative Service Cyber Operations Field Office and the Air Force Office of Special Investigations.

Cottage Industry in U.S. for Refugee Resettlement

There was a time when the U.S. State Department along with associated agencies including USAID and the CIA would work to migrate countries from communism to democracies. After the rise of militant Islam and terror attacks around the world, countless gestures have been launched to destroy terror including of course war. Stable countries are now vulnerable and susceptible to radical migrant refugees and migrants.

Europe is in the worst condition and the United States is functioning in much the same manner. We constantly hear that the United States was built on immigrants and we invite legal immigration. Few conceive the notion that immigrants would not seek out America if there home countries were stable, democratic and functioning especially when the United States sends billions each year offshore for assistance and stability.

Meanwhile, America continues to budget and appropriate funds for migrants and refugees in the United States and more coming.

Image result for Reception and Placement Programphoto

For an exact sample on how the states operate, this site provided some great insight using Michigan.

Do you wonder what the total and comprehensive costs are for refugee resettlement? Well, the General Accounting Office is to report those costs, yet there seems to be no recent report. Meanwhile see pages 8-9 for the resettlement numbers by state by clicking here.

FY 2017 Notice of Funding Opportunity for Reception and Placement Program

Funding Procedures

Under current funding procedures, each agency with which the Bureau enters into a Cooperative Agreement (CA) is provided $2,025 for each refugee it sponsors who arrives in the United States during the period of the CA and is verified to have been placed and assisted by the agency. The funding is intended to supplement private resources available to the applicant and may be used at the local affiliates at which refugees are resettled and only for the direct benefit of refugees and for the delivery of services to refugees in accordance with program requirements as described in the CA. In addition, the Bureau funds national R&P Program management costs according to separately negotiated and approved budgets based on the applicant’s sponsorship capacity.

The annual ceiling for refugee admissions will be established by the President following consultations with the Congress towards the end of FY 2016. The FY 2017 appropriation and refugee ceiling have not yet been determined. For planning purposes, applicants should use the following refugee admissions projections as a baseline, although they may not necessarily be the regional or total ceilings that will be set by the President for FY 2017. Projections by region are as follows:

Africa — 30,000

East Asia — 12,000

Europe and Central Asia — 5,000

Latin America and the Caribbean — 5,000

Near East and South Asia — 44,000

Unallocated Reserve — 4,000

In addition, applicants should include 7,000 Special Immigrant Visa (SIV) recipients in their planning.

As in previous years, applicants should base their placement plans provided to PRM in response to this notice of funding opportunity on the capacity of their network of local affiliates, which will have consulted with resettlement partners in their communities in order to ensure that the placement plans are reasonable and appropriate. Should the FY 2017 Presidential Determination and appropriation processes result in ceilings that are different from the total capacity that has been proposed by all approved applicants, the Bureau will work with approved applicants, as necessary, to develop a revised plan, as it has in previous years. If you can stand it, continue the stipulations and grant procedures here.

***

It has become a cottage industry with almost zero checks and balances and your tax dollars? Well glad you asked. Check it:

Requirements to resettle refugees
To be selected as an R&P program agency, a non-governmental organization must apply to the PRM, which stipulates they meet three requirements:
1. Applicants must be “well-established social service providers with demonstrated case management expertise and experience managing a network of affiliates that provide reception and placement or similar services to refugees or other migrant populations in the United States;
2. (they must) have been in operation for at least three full years in non-profit status;
3. and document the availability of private financial resources to contribute to the program” (FY 2012 Funding Opportunity Announcement for Reception and Placement Program).

How it works 
Each agency enters into a Cooperative Agreement (CA) with the PRM and is provided $1800 per refugee it sponsors who arrives in the U.S. during the period of the CA. Resettlement agencies have voluntary agreements with the Office of Refugee Resettlement within the U.S. Department of Health and Human Services (US DHHS). The resettlement agencies generally receive seven to ten days notice prior to the arrival of a refugee so that they can assign a case manager, find housing, furniture, and purchase necessary household items. If the refugee has a relative or other tie already living in the U.S. (called an “anchor”), the resettlement agency usually establishes an agreement before the refugees arrive to determine the role the relative or tie will have in assisting the newly arrived refugee in accessing core services.

Service period & basic services
The R&P service period is thirty days long, but can be extended to up to ninety days if more time is necessary to complete delivery of R&P services, although some service agencies allow extensions of assistance based on a client’s needs. Basic support consists of the provision of:
1. Decent, safe, sanitary, and affordable housing
2. Essential furnishings
3. Appropriate food and food allowances
4. Necessary clothing
5. Assistance in applying for social security cards
6. Assistance in registering children in school
7. Transportation to job interviews and job training
8. At least two home visits
9. An initial housing orientation visit by a designated R&P representative or case manager
10. Assistance in obtaining health screening and mental health services
11. Obtaining employment services
12. Obtaining appropriate benefits
13. Referrals to social service programs
14. Enrollment in English as a Second Language instruction.
15. Pre-arrival processing & reception planning
16. Airport pickup
17. Hot meal on night of arrival
18. General case management
19. Development and implementation of a resettlement plan
20. Cultural orientation classes
21. Employment assessment and possible enrollment in UST’s employment program
22. Referrals to UST internal programs
23. Advocacy within government and social services agencies
24. Coordination of community volunteers that provide additional adjustment assistance
25. Follow up and basic needs support

If refugees are still in need of assistance after this 30-90 day period, they can seek aid from public benefit programs for up to seven years. Refugees retain their status as such for one year, and then are considered permanent residents for four years. After that, they can apply for U.S. citizenship.

Other services listed on our website are also accessible to our clients.  Some services are subject to office location.

 

AP Blames FBI for Few Warning on Fancy Bear Hacks

While much of the global hacking came to a scandal status in 2015-16, the Russian ‘Fancy Bear’ activity goes back to at least 2008. The FBI is an investigative wing and works in collaboration with foreign intelligence and outside cyber experts. For official warnings to be provided to U.S. government agencies, contractors, media or political operations, the FBI will generally make an official visit to affected entities to gather evidence. The NSA, Cyber Command and the DHS all have cyber experts that track and work to make accurate attributions of the hackers.

Image result for fancy bear apt 28

The Department of Homeland Security is generally the agency to make official warnings. The Associated Press gathered independent cyber experts to perform an independent study and is ready to blame the FBI for not going far enough in warnings.

When it came to the Clinton presidential campaign hack, the FBI made several attempts to officials there and were met with disdain and distrust. The FBI wanted copies of the ‘log-in’ files for evidence and were denied.

In part the AP report states:

“CLOAK-AND-DAGGER”

In the absence of any official warning, some of those contacted by AP brushed off the idea that they were taken in by a foreign power’s intelligence service.

“I don’t open anything I don’t recognize,” said Joseph Barnard, who headed the personnel recovery branch of the Air Force’s Air Combat Command.

That may well be true of Barnard; Secureworks’ data suggests he never clicked the malicious link sent to him in June 2015. But it isn’t true of everyone.

An AP analysis of the data suggests that out of 312 U.S. military and government figures targeted by Fancy Bear, 131 clicked the links sent to them. That could mean that as many as 2 in 5 came perilously close to handing over their passwords.

It’s not clear how many gave up their credentials in the end or what the hackers may have acquired.

Some of those accounts hold emails that go back years, when even many of the retired officials still occupied sensitive posts.

Overwhelmingly, interviewees told AP they kept classified material out of their Gmail inboxes, but intelligence experts said Russian spies could use personal correspondence as a springboard for further hacking, recruitment or even blackmail.

“You start to have information you might be able to leverage against that person,” said Sina Beaghley, a researcher at the RAND Corp. who served on the NSC until 2014.

In the few cases where the FBI did warn targets, they were sometimes left little wiser about what was going on or what to do.

Rob “Butch” Bracknell, a 20-year military veteran who works as a NATO lawyer in Norfolk, Virginia, said an FBI agent visited him about a year ago to examine his emails and warn him that a “foreign actor” was trying to break into his account.

“He was real cloak-and-dagger about it,” Bracknell said. “He came here to my work, wrote in his little notebook and away he went.”

Left to fend for themselves, some targets have been improvising their cybersecurity.

Retired Gen. Roger A. Brady, who was responsible for American nuclear weapons in Europe as part of his past role as commander of the U.S. Air Force there, turned to Apple support this year when he noticed something suspicious on his computer. Hughes, a former DIA head, said he had his hard drive replaced by the “Geek Squad” at a Best Buy in Florida after his machine began behaving strangely. Keller, the former senior spy satellite official, said it was his son who told him his emails had been posted to the web after getting a Google alert in June 2016.

A former U.S. ambassador to Russia, Michael McFaul, who like many others was repeatedly targeted by Fancy Bear but has yet to receive any warning from the FBI, said the lackluster response risked something worse than last year’s parade of leaks.

“Our government needs to be taking greater responsibility to defend its citizens in both the physical and cyber worlds, now, before a cyberattack produces an even more catastrophic outcome than we have already experienced,” McFaul said. Read the full article here.

Image result for fancy bear apt 28 photo

***

Every organization has a Chief Technology Officer, even small business has a ‘go-to’ person for issues. To be in denial there are any vulnerabilities is reckless and dangerous. To assume systems are adequately protected against cyber intrusions is also derelict in duty.

Fancy Bear is listed as APT 28. APT=Advanced Persistent Threat.

APT28 made at least two attempts to compromise Eastern European government organizations:
In a late 2013 incident, a FireEye device
deployed at an Eastern European Ministry of
Foreign Affairs detected APT28 malware in
the client’s network.
More recently, in August 2014 APT28 used a
lure (Figure 3) about hostilities surrounding a
Malaysia Airlines flight downed in Ukraine in
a probable attempt to compromise the Polish
government. A SOURFACE sample employed
in the same Malaysia Airlines lure was
referenced by a Polish computer security
company in a blog post.
The Polish security
company indicated that the sample was “sent
to the government,” presumably the Polish
government, given the company’s locations and visibility.
Additionally:
Other probable APT28 targets that we have
identified:
Norwegian Army (Forsvaret)
Government of Mexico
Chilean Military
Pakistani Navy
U.S. Defense Contractors
European Embassy in Iraq
Special Operations Forces Exhibition (SOFEX)
in Jordan
Defense Attaches in East Asia
Asia-Pacific Economic Cooperation
There is also NATO, the World Bank and military trade shows. Pure and simple, it is industrial espionage.
MALWARE
Evolves and Maintains Tools for Continued, Long-Term Use
Uses malware with flexible and lasting platforms
Constantly evolves malware samples for continued use
Malware is tailored to specific victims’ environments, and is designed to hamper reverse engineering efforts
Development in a formal code development environment
Various Data Theft Techniques
Backdoors using HTTP protocol
Backdoors using victim mail server
Local copying to defeat closed/air gapped networks
TARGETING
Georgia and the Caucasus
Ministry of Internal Affairs
Ministry of Defense
Journalist writing on Caucasus issues
Kavkaz Center
Eastern European Governments & Militaries
Polish Government
Hungarian Government
Ministry of Foreign Affairs in Eastern Europe
Baltic Host exercises
Security-related Organizations
NATO
OSCE
Defense attaches
Defense events and exhibitions
RUSSIAN ATTRIBUTES
Russian Language Indicators
Consistent use of Russian language in malware over a period of six years
Lure to journalist writing on Caucasus issues suggests APT28 understands both Russian and English
Malware Compile Times Correspond to Work Day in Moscow’s Time Zone
Consistent among APT28 samples with compile times from 2007 to 2014
The compile times align with the standard workday in the UTC + 4 time zone which includes major Russian cities such as Moscow and St. Petersburg
FireEye, is a non-government independent cyber agencies that has performed and continues to perform cyber investigations and attributions. There are others that do the same. To blame exclusively the FBI for lack of warnings is unfair.
Hacking conditions were especially common during the Obama administration and countless hearings have been held on The Hill, while still there is no cyber policy, legislation or real consequence. Remember too, it was the Obama administration that chose to do nothing with regard to Russia’s interference until after the election in November and then only in December did Obama expel several Russians part of diplomatic operations and those possibly working under cover including shuttering two dachas and one mission post in San Francisco.