Russian Hackers Also Hit the Clinton Foundation

Posted on June 21, 2016June 21, 2016 by Denise Simon

So, global adversaries came to understand early that much of the covert and diplomatic work and connections by Hillary Clinton during her term as senator and later as Secretary of State was going on in a dual location, meaning the Clinton Foundation and the U.S. State Department. So….let the hacking begin, and they did.

Now there is a question: Are there more than one servers? Evidence speaks to the answer, YES. See this item from Forbes where there are clues.

Records reveal that Hillary Clinton’s private clintonemail.com server shared an IP address with her husband Bill Clinton’s email server, presidentclinton.com, and both servers were housed in New York City, not in the basement of the Clintons’ Chappaqua, New York home.

Web archives show that the Presidentclinton.com Web address was being operated by the Clinton Foundation as of 2009, when Hillary Clinton registered her own clintonemail.com server.

Numerous Clinton Foundation employees used the presidentclinton.com server for their own email addresses, which means that they were using email accounts that, if hacked, would have given any hacker complete access to Hillary Clinton’s State Department emails, as well. More here.

Clinton Foundation Said to Be Breached by Russian Hackers

Bloomberg: The Bill, Hillary and Chelsea Clinton Foundation was among the organizations breached by suspected Russian hackers in a dragnet of the U.S. political apparatus ahead of the November election, according to three people familiar with the matter.

The attacks on the foundation’s network, as well as those of the Democratic Party and Hillary Clinton’s presidential campaign, compound concerns about her digital security even as the FBI continues to investigate her use of a personal e-mail server while she was secretary of state.

A spokesman for the foundation, Brian Cookstra, said he wasn’t aware of any breach. The compromise of the foundation’s computers was first identified by government investigators as recently as last week, the people familiar with the matter said. Agents monitor servers used by hackers to communicate with their targets, giving them a back channel view of attacks, often even before the victims detect them.

For a primer on recent cyber intrusions, click here.

Before the Democratic National Committee disclosed a major computer breach last week, U.S. officials informed both political parties and the presidential campaigns of Clinton, Donald Trump and Bernie Sanders that sophisticated hackers were attempting to penetrate their computers, according to a person familiar with the government investigation into the attacks.

The hackers in fact sought data from at least 4,000 individuals associated with U.S. politics — party aides, advisers, lawyers and foundations — for about seven months through mid-May, according to another person familiar with the investigations.

Thousands of Documents

The thefts set the stage for what could be a Washington remake of the public shaming that shook Sony in 2014, when thousands of inflammatory internal e-mails filled with gossip about world leaders and Hollywood stars were made public. Donor information and opposition research on Trump purportedly stolen from the Democratic Party has surfaced online, and the culprit has threatened to publish thousands more documents.

Related reading: Clinton Investigation for Public Corruption

Related reading: FBI Maintaining Server for Evidence

A hacker or group of hackers calling themselves Guccifer 2.0 posted another trove of documents purportedly from the DNC on Tuesday, including what they said was a list of donors who had made large contributions to the Clinton Foundation.

The Republican Party and the Trump campaign have been mostly silent on the computer attacks. In an earlier statement, Trump said the hack was a political ploy concocted by the Democrats.

Information about the scope of the attacks and the government warnings raises new questions about how long the campaigns have known about the threats and whether they have done enough to protect their systems.

The Clinton campaign was aware as early as April that it had been targeted by hackers with links to the Russian government on at least four recent occasions, according to a person familiar with the campaign’s computer security.

U.S. Inquiries

The U.S. Secret Service, Federal Bureau of Investigation and National Security Agency are all involved in the investigation of the theft of data from the political parties and individuals over the last several months, one of the people familiar with the investigation said. The agencies have made no public statements about their inquiry.

The FBI has been careful to keep that investigation separate from the review of Clinton’s use of private e-mail, using separate investigators, according to the person briefed on the matter. The agencies didn’t immediately respond to requests for comment.

Clinton spokesman Glen Caplin said that he couldn’t comment on government briefings about cyber security and that the campaign had no evidence that its systems were compromised.

“We routinely communicate and cooperate with government agencies on security-related matters,” he said. “What appears evident is that the Russian groups responsible for the DNC hack are intent on attempting to influence the outcome of this election.”

The DNC wouldn’t directly address the attacks but said in a written statement that it believes the leaks are “part of a disinformation campaign by the Russians.”

Trump spokeswoman Hope Hicks didn’t respond to e-mails seeking comment about the government warnings. The Republican National Committee didn’t respond to e-mail messages. A Sanders spokesman, Michael Briggs, said he wasn’t aware of the warnings.

IDing the Hackers

The government’s investigation is following a similar path as the DNC’s, including trying to precisely identify the hackers and their possible motives, according to people familiar with the investigations. The hackers’ link to the Russian government was first identified by CrowdStrike Inc., working for the Democratic Party.

A law firm reviewing the DNC’s initial findings, Baker & McKenzie, has begun working with three additional security firms — FireEye Inc., Palo Alto Networks Inc. and Fidelis Cybersecurity — to confirm the link, according to two people familiar with the matter, underscoring Democrats’ concerns that the stolen information could be used to try to influence the outcome of the November election.

A spokesman for Baker & McKenzie didn’t immediately respond to requests for comment. DNC spokesman Luis Miranda said the party worked only with CrowdStrike.

If the Democrats can show the hidden hand of Russian intelligence agencies, they believe that voter outrage will probably outweigh any embarrassing revelations, a person familiar with the party’s thinking said.

So far the released documents have revealed little that is new or explosive, but that could change. Guccifer 2.0 has threatened to eventually release thousands of internal memos and other documents.

Line of Attack

Sensitive documents from the Clinton Foundation could have the most damaging potential. The Trump camp has said it plans to make the foundation’s activities a subject of attacks against Clinton; the sort of confidential data contained in e-mails, databases and other digital archives could aid that effort.

An analysis by Fidelis confirmed that groups linked to Russian intelligence agencies were behind the DNC hack, according to a published report.

The government fills a crucial gap in flagging attacks that organizations can’t detect themselves, said Tony Lawrence, a former U.S. Army cyber specialist and now chief executive officer of VOR Technology, a computer security company in Hanover, Maryland.

“These state actors spend billions of dollars on exploits to gather information on candidates, and nine times out of ten [victims] won’t be able to identify or attribute them,” he said.

Google Accounts

Bloomberg News reported Friday that the hackers who hit the DNC and Clinton’s campaign burrowed much further into the U.S. political system than initially thought, sweeping in law firms, lobbyists, consultants, foundations and policy groups in a campaign that targeted thousands of Google e-mail accounts and lasted from October through mid-May.

Data from the attacks have led some security researchers to conclude that the hackers were linked to Russian intelligence services and were broadly successful in stealing reports, policy papers, correspondence and other information. Dmitry Peskov, a spokesman for President Vladimir Putin, denied that the Russian government was involved.

Russia uses sophisticated “information operations” to advance foreign policy, and the target audience for this kind of mission wouldn’t be U.S. voters or even U.S. politicians, said Brendan Conlon, who once led a National Security Agency hacking unit.

“Why would Russia go to this trouble? Simple answer — because it met their foreign policy objectives, to weaken the U.S. in the eyes of our allies and adversaries,” said Conlon, now CEO of Vahna Inc., a cyber security firm in Washington. Publishing the DNC report on Trump “weakens both candidates — lists out all the weaknesses of Trump specifically while highlighting weaknesses of Clinton’s security issues. The end result is a weaker president once elected.”

Russia Link

Russia has an expansive cyber force that it has deployed in complex disinformation campaigns throughout Europe, according to intelligence officials.

BfV, the German intelligence agency, has concluded that Russia was responsible for a 2015 hack against the Bundestag that forced shutdown of its computer systems for several days. Germany is under “permanent threat” from Russian hackers, said BfV chief Hans-Georeg Maassen.

Security software maker Trend Micro said in May that Russian hackers had been trying for several weeks to steal data from Chancellor Angela Merkel’s Christian Democratic Union party, and that they also tried to hack the Dutch Safety Board computer systems to obtain an advance copy of a report on the downing of a Malaysian aircraft over Ukraine in July 2014. The report said the plane was brought down by a Russian-made Buk surface-to-air missile.

The cyber attacks are part of a broader pattern of state-sponsored hacking by Russia focused on political targets, with a goal of giving Russia the upper hand in dealing with other governments, said Pasi Eronen, a Helsinki-based cyber warfare researcher who has advised Finland’s Defense Ministry.

Obama’s Retribution Against Florida, Orlando Terror Attack

Posted on June 20, 2016June 20, 2016 by Denise Simon

Shameful…yet this administration knows no shame. Reprehensible….

FEMA denies request for emergency declaration following Pulse shooting

OrlandoSentinel: A request to the federal government to declare an emergency for the state of Florida following the Pulse nightclub shooting was denied today, according to statement from Gov. Rick Scott‘s office.

“Because your request did not demonstrate how the emergency response associated with this situation is beyond the capability of the State and affected local governments… your request for an emergency declaration is denied,” W. Craig Fugate, administrator for the Federal Emergency Management Agency, said in a letter to Scott.

On Twitter, Scott called the denial “disappointing” and “unthinkable.”

If grated, the formal declaration of emergency would have made available $5 million in federal funding.

Scott said the money would have been used to cover the expense of provisions for health and safety measures and managing, controlling and reducing the immediate threat to public health and safety.

“It is incredibly disappointing that the Obama Administration denied our request for an Emergency Declaration,” Scott said on Twitter. “It is unthinkable that (the president) does not define the Orlando terror attack, the deadliest shooting in U.S. history, as an emergency.

“We’re committing every state resource possible to help the victims and the community heal and we expect the same from the federal government.”

Scott’s office has 30 days to appeal the denial.

Despite the denial, the federal government will allocate $253,000 to pay for overtime for the first responders who assisted the victims of the Pulse shooting, Scott’s office said.

What the DoJ Wont Tell you About Mateen’s Father

Posted on June 20, 2016June 20, 2016 by Denise Simon

IPTNews: by Abha Shankar

The father of Orlando mass shooter Omar Mateen has longstanding connections to prominent Islamist groups in the U.S., a document discovered by the Investigative Project on Terrorism shows. Seddique Matin is listed as president of a then-new American Muslim Alliance (AMA) chapter in Fort Pierce in a July 1997 announcement archived by the IPT.

The AMA sponsored several radical conferences in the U.S. and its leader, Agha Saeed, has spoken in defense of convicted terrorists, including Aafia Siddiqui (a.k.a “Lady al-Qaida”), Palestinian Islamic Jihad board member Sami Al-Arian, and Pakistani intelligence lobbyist Ghulam Nabi Fai.

The Fort Pierce chapter is among 10 new AMA chapters opened, the announcement in an AMA bulletin says.

AMA was incorporated as a nonprofit organization in California in 1994 “to educate the Muslim community and others on the history and laws of the United States and on affirmative participation in civic activities on a non-partisan basis.” AMA’s political activist wing, the American Muslim Political Coordinating Council (AMPCC), includes leading Islamist organizations in the U.S. including the Council on American-Islamic Relations (CAIR), the Muslim Public Affairs Council (MPAC), and the American Muslim Council (AMC).

AMA no longer exists as a registered nonprofit and it last filed tax returns in 2010. But the organization continues to maintain an active Facebook account. In its posts, the AMA refuses to consider any Islamist motivation for the attack and lays the blame for Omar Mateen’s massacre which killed 49 people at the Pulse nightclub solely on the country’s lax gun laws.

The organization has a history of working with radical Islamist groups and has issued statements in support of several terrorists later convicted in the U.S. The FBI cut off outreach communication with CAIR, for example, after uncovering evidence placing the organization and its leaders in a U.S.-based Hamas-support network.

In October 2000, AMA co-sponsored a rally in Washington’s Lafayette Park where AMC’s then-executive director Abdurahman Alamoudi announced his support for Hamas and Hizballah.

In 2004, Alamoudi was sentenced to 23 years in prison for illegal financial dealings with Libya. He also confessed to taking part in a Libyan plot to assassinate then-crown prince of Saudi Arabia.

In 2003, Saeed testified on Al-Arian’s behalf, describing the man who ran “the active arm” of Palestinian Islamic Jihad as “my friend and during the last ten years we have worked together to mainstream American politics. We have worked together to replace the culture of despair with culture of hope and the culture of bullet with the culture of ballot.” AMA’s website also featured a section entitled “Valiant Civil Rights Struggle of Dr. Sami Al Arian.”

Saeed also penned an op-ed along with CAIR’s then-national board chairman Parvez Ahmed that called for Al-Arian’s release from prison during a subsequent contempt case. The op-ed criticized U.S. counterterrorism efforts claiming “the saga of Dr. Sami Al-Arian is a repeat of past incidents in American history in which our government targeted individuals using unconstitutional and un-American tactics.”

Saeed advocated “armed resistance” at a 1999 Islamic Society of North America (ISNA) in Chicago: “United Nations has a resolution…which says… people in Palestine have the right to resist their oppression by using all means including armed resistance….” Saeed was featured as a guest speaker at Islamic Association for Palestine (IAP) conventions. Evidence unearthed in a Hamas-financing trial in Dallas, showed IAP served as a propaganda machine for the terrorist group in the U.S.

At AMA’s 7^th Annual National Convention in October 2002, Agha Saeed indirectly blamed the U.S. for the 9/11 attacks. Osama bin Laden was contemptible, he said. “But I would like to say very respectfully, who brought Osama bin Laden from Saudi Arabia to Afghanistan? Who gave him million[s] of dollars? Who trained him in [the] science of war, death and destruction, deception and deceit? Who gave protection to his cause and diplomatic coverage to his enterprise? Was it not President Reagan, when he had to see mujahideen at the White House, he said, ‘When I meet you I feel as if I am in the company of the founding fathers of this country?'”

Years after working with AMA and its Islamist allies, the senior Mateen, who hosts the Durand Jirga Show from California on the YouTube channel Payam-e-Afghan, has been reported to be an ideological supporter of the Taliban. He can be seen in one video declaring his candidacy for the Afghan presidency. In another video, Mateen can be seen praising the Afghan Taliban and referring to the terrorist group as “our warrior brothers,” the Washington Post reports.

While little information is known about Seddique Mateen’s work with the AMA, the 1997 newsletter shows the Orlando shooter’s father has worked for years with some of the most visible and radical Islamists in the United States.

DoJ Released Censored 911 Calls from Orlando Attack

Posted on June 20, 2016June 20, 2016 by Denise Simon

Afternoon update: Fortunately, the emergency service call centre records all their calls using Transcription Services. From this, although the FBI are under great pressure, they release the full transcript of ONE call.

Transcript of Orlando Police Department 911 Calls, June 12, 2016

2:35 a.m.: Shooter contacted a 911 operator from inside Pulse. The call lasted approximately 50 seconds, the details of which are set out below:

(OD)   Orlando Police Dispatcher

(OM)   Omar Mateen

OD:     Emergency 911, this is being recorded.

OM:     In the name of God the Merciful, the beneficent [Arabic]

OD:     What?

OM:     Praise be to God, and prayers as well as peace be upon the prophet of God [Arabic]. I wanna let you know, I’m in Orlando and I did the shootings.

OD:     What’s your name?

OM:     My name is I pledge of allegiance to Abu Bakr al-Baghdadi of the Islamic State.

OD:     Ok, What’s your name?

OM:     I pledge allegiance to Abu Bakr al-Baghdadi may God protect him [Arabic], on behalf of the Islamic State.

OD:     Alright, where are you at?

OM:     In Orlando.

OD:     Where in Orlando?

[End of call.]

From the FBI: Release full summary.

All the additional important facts of war, terror and national security are redacted and or omitted. Sigh..

Omar was in an active exchange of gunfire with law enforcement until he barricaded himself in the bathroom with hostages. At this time, an estimated 3 hours, several things were going on, he was calling media outlets, he was searching the internet and mostly law enforcement were taking his words and statements as facts including have several suicide vests, a vehicle with explosives and he would kill the hostages. Law Enforcement brought in a negotiation team and actively engaged Omar. During this time, other resources were deployed including efforts to obtain live inside the club video, reaching hostages and to determine how and where a ‘bearcat’ would be used to rescue those held inside. Once the breach was made the second live fire exchange took place and Omar was eventually killed.

FBI Releases Transcripts of 911 Calls from Orlando Massacre

NBC: The FBI on Monday began releasing transcripts of 911 calls from the Orlando nightclub massacre.

Orlando Police Dispatcher (OD): Emergency 911, this is being recorded.

Shooter (OM): In the name of God the Merciful, the beneficial [in Arabic]

OD: What?

OM: Praise be to God, and prayers as well as peace be upon the prophet of God [in Arabic]. I let you know, I’m in Orlando and I did the shootings.

OD: What’s your name?

OM: My name is I pledge of allegiance to [omitted].

OD: Ok, What’s your name?

OM: I pledge allegiance to [omitted] may God protect him [in Arabic], on behalf of [omitted].

OD: Alright, where are you at?

OM: In Orlando.

OD: Where in Orlando?

[End of call.]

News Release from the FBI:

www.fbi.gov/Tampa @FBITampa www.facebook.com/FBI Follow us at:

NEWS RELEASE

Federal Bureau of Investigation

Tampa Field Office

FBI Media Representative:

Special Agent Amy Pittman

Phone Number: (813) 253-1000

For Immediate Distribution: June 20, 2016

Investigative Update Regarding Pulse Nightclub Shooting

ORLANDO – In order to provide an update on the progress of the investigation into the Pulse nightclub shooting, the FBI is releasing an excerpt from the timeline of events inside the Pulse nightclub during the early morning hours of Sunday, June 12, 2016. Out of respect for the victims of this horrific tragedy, law enforcement will not be releasing audio of the shooter’s 911 calls at this time,nor will law enforcement be releasing audio or transcripts of the calls made by victims at the Pulse nightclub during the incident. Furthermore, the name of the shooter and that of the person/group to whom he pledged allegiance are omitted.

The following is based on Orlando Police Department (OPD) radio communication (times are approximate):

2:02 a.m.: OPD call transmitted multiple shots fired at Pulse nightclub.

2:04a.m.: Additional OPD officers arrived on scene.

2:08 a.m.: Officers from various law enforcement agencies made entrance to Pulse and engaged the shooter.

2:18 a.m.: OPD S.W.A.T. (Special Weapons & Tactics) initiated a full call-out.

2:35 a.m.: Shooter contacted a 911 operator from inside Pulse. The call lasted approximately 50 seconds, the details of which are set out below:

Orlando Police Dispatcher (OD) Shooter (OM)

OD: Emergency 911, this is being recorded.

OM: In the name of God the Merciful, the beneficial [in Arabic] OD: What?

OM: Praise be to God, and prayers as well as peace be upon the prophet of God [in Arabic]. I let you know, I’m in Orlando and I did the shootings.

OD: What’s your name? OM: My name is I pledge of allegiance to [omitted]. OD: Ok, What’s your name?

OM: I pledge allegiance to [omitted] may God protect him [in Arabic], on behalf of [omitted].

OD: Alright, where are you at? www.fbi.gov/Tampa @FBITampa www.facebook.com/FBI Follow us at:

OM: In Orlando.

OD: Where in Orlando?

[End of call.]

(Shortly thereafter, the shooter engaged in three conversations with OPD’s Crisis Negotiation Team.)

2:48 a.m.: First crisis negotiation call occurred lasting approximately nine minutes.

3:03 a.m.: Second crisis negotiation call occurred lasting approximately 16 minutes.

3:24 a.m.: Third crisis negotiation call occurred lasting approximately three minutes.

In these calls, the shooter, who identified himself as an Islamic soldier, told the crisis negotiator that he was the person who pledged his allegiance to [omitted], and told the negotiator to tell America to stop bombing Syria and Iraq and that is why he was “out here right now.” When the crisis negotiator asked the shooter what he had done, the shooter stated, “No, you already know what I did.” The shooter continued, stating, “There is some vehicle outside that has some bombs, just to let you know. You people are gonna get it, and I’m gonna ignite it if they try to do anything stupid.” Later in the call with the crisis negotiator, the shooter stated that he had a vest, and further described it as the kind they “used in France.” The shooter later stated, “In the next few days, you’re going to see more of this type of action going on.” The shooter hung up and multiple attempts to get in touch with him were unsuccessful.

4:21 a.m.: OPD pulled an air conditioning unit out of a Pulse dressing room window for victims to evacuate.

(While the FBI will not be releasing transcripts of OPD communication with victims, significant information obtained from those victims allowed OPD to gain knowledge of the situation inside Pulse.)

4:29 a.m.: As victims were being rescued, they told OPD the shooter said he was going to put four vests with bombs on victims within 15 minutes.

(An immediate search of the shooter’s vehicle on scene and inside Pulse ultimately revealed no vest or improvised explosive device.)

5:02 a.m.: OPD SWAT and OCSO Hazardous Device Team began to breach wall with explosive charge and armored vehicle to make entry.

5:14 a.m.: OPD radio communicationstated that shots were fired.

5:15 a.m.: OPD radio communication stated that OPD engaged the suspect and the suspect wasreported down.

Based on OPD radio communications, there were no reports of shots being fired inside Pulse between the initial exchange of gunfire between responding officers and shooter, www.fbi.gov/Tampa @FBITampa www.facebook.com/FBI Follow us at:

and the time of the final breach. During this time, the shooter communicated with an OPD 911 operator and an OPD crisis negotiator, and OPD radio communications reported that victims were being rescued.

The FBI urges the public to provide information about the shooter and any contact they may have had with him. Since the release of the FBI’s Seeking Information poster, the FBI has received thousands of tips. The FBI will investigate every tip.

To provide a tip, please call1-800-CALL-FBI or visit tips.fbi.gov.

Islamic State Threatens U.S. Military Bases

Posted on June 20, 2016June 20, 2016 by Denise Simon

S. Korea beefs up security after Islamic State threatens US bases

Stripes: SEOUL, South Korea— The South Korean government said Monday it will step up security measures against potential terrorist threats after U.S. air bases and a South Korean civilian reportedly appeared on a list of targets circulated by a pro-Islamic State group of hackers.

Gen. Vincent Brooks, U.S. Forces Korea commander, and Gen. Lee Soon-jim, of the South Korean joint chiefs of staff, receive a briefing at the Joint Security Area of the Demilitarized Zone Thursday, May 12, 2016. The South Korean government reported Monday that U.S. bases and a South Korean civilian appeared on a list of targets circulated by pro-Islamic State hackers.

U.S. Forces Korea said the alert levels at military installations on the divided peninsula have not changed but stressed it is ready to respond “at any time to any emerging threats.”

Concern was raised over the weekend when South Korea’s state spy agency said Islamic State has called for attacks by revealing the locations of 77 U.S. and NATO air force installations, including Osan and Kunsan air bases, on messaging services. A South Korean employee of a welfare organization also was listed, the agency said.

The list included targets in several countries and was a troubling reminder that South Korea faces possible threats beyond its longtime rival to the north. The two Koreas remain technically at war since the 1950-53 conflict ended in an armistice instead of a peace treaty. Some 28,500 American servicemembers are stationed in the South.

The National Intelligence Service statement warned that “terror against South Korean citizens and foreigners in this country is becoming a reality.”

The spy agency apparently was referring to a so-called kill list released earlier this month by a pro-ISIS hacking group known as the United Cyber Caliphate with the names, addresses and email addresses of more than 8,000 people. It was not clear how or why the individuals were selected.

The group also published satellite images showing U.S. air bases around the world, although the same images can be found on Google Earth, according to Vocativ, a media and technology company that reported on the list on June 8.

NIS said it had told the U.S. military and South Korean military and police agencies to be on guard and to provide sufficient protection for the facilities mentioned by the group.

USFK said it takes the safety of the installations very seriously and remains committed to ensuring the highest degree of security on the peninsula.

“Through constant vigilance and regular exercises with our South Korean counterparts, we remain prepared to respond at any time to any emerging threats,” it said in an emailed statement.

South Korean Prime Minister Hwang Kyo-ahn said Monday that the government will come up with measures to prevent terrorist attacks, the Yonhap news agency reported. He said the nation’s counterterrorism center also will increase investigations and take every possible step to protect the public.

“The Islamic State of Iraq and the Levant has been citing South Korea as a potential target for its attacks since last September,” Hwang was quoted as saying.

**** From SCMagazine in April:

Several ISIS hacking groups announced on social media that they have joined forces to form a mega hacking group called United Cyber Caliphate (UCC).

Last week, threat actors in the group posted the names and addresses of 3,602 of the “most important citizens” of #NewYork and #Brooklyn and called for ISIS sympathizers to use the information to carry out lone wolf attacks, according to Techworm.

The list includes about 3,000 ordinary New Yorkers who have no specific ties to the government. The majority of the people on the list live in Manhattan and Brookly and each will receive a visit from the Federal Bureau of Investigations and the NYPD to discuss the issue, according to NBC4 New York.

During the same time, the group reportedly defaced the website of a Michigan church, leaving behind ISIS propaganda as part of a larger campaign using the “#KillCrusaders” hashtag.

UCC also claimed to have launched a cyberattack against the U.S. State Department that resulted in the leaked the data of about 50 employees, and defacement campaigns that targeted multiple Australian websites and the Russian Federal Customs Service.

The group also took credit for an attack that leaked the data of 18,000 Saudi Ministry of Defense and Aviation employees.

Update 4/27: UCC this week published a new kill list featuring names linked to the U.S. State Department, the DHS and other federal agencies, according to a report from Vocativ.