Category Archives: Russia

Leaked DHS email Explains ANTIFA Portland is Organized

Posted on by

Primer: Rose City Antifa (RCA) was founded in Portland, Oregon in October of 2007. RCA was formed after a coalition of local people and organizations formed the ‘Ad-Hoc Coalition Against Racism and Fascism’.

Portland & Antifa: National Review Cover Story — Kevin ... photo

Source:

An internal email from the Department of Homeland Security leaked to CBS Catherine Herridge late Monday detailing that the violence in Portland was not “opportunistic,” but rather “organized”—confirming long-suspected details about the Antifa movement.

The email explains that Antifa is organized and runs contrary to reports in the mainstream media that Antifa was not responsible for anti-police violence, but an impromptu movement spurred on by anti-fascist sentiments held by most of the American public.

A recent article in the Washington Post by Mark Bray, author of Antifa: Anti-Fascist Handbook, attempted to dispel “myths” about Antifa, claims that the group is not an organization, but rather a “tradition of militant antifascism.” The article disputed claims that Antifa “masterminds violence at Black Lives Matter protests.”

An internal email from the Department of Homeland Security leaked to CBS Catherine Herridge late Monday detailing that the violence in Portland was not “opportunistic,” but rather “organized”—confirming long-suspected details about the Antifa movement.

The email explains that Antifa is organized and runs contrary to reports in the mainstream media that Antifa was not responsible for anti-police violence, but an impromptu movement spurred on by anti-fascist sentiments held by most of the American public.

A recent article in the Washington Post by Mark Bray, author of Antifa: Anti-Fascist Handbook, attempted to dispel “myths” about Antifa, claims that the group is not an organization, but rather a “tradition of militant antifascism.” The article disputed claims that Antifa “masterminds violence at Black Lives Matter protests.”

**

 

 

“Threat actors who are motivated by Anarchist or ANTIFA (or a combination of both) ideologies to carry out acts of violence against State, Local, and Federal authorities and infrastructure they believe represent authority or represent political and social ideas they reject,” Murphy concluded.

Phrases like “Every city, every town. Burn the precincts to the ground” are a common refrain at Black Lives Matter rallies, and have been chanted during arson attacks on the Portland Police Bureau, the Mark O. Hatfield federal courthouse in Portland, and other facilities where Antifa and Black Lives Matter militants were present.

The intelligence provided by the DHS validates claims by conservative voices who have long identified Antifa as an organized movement, and flies in the face of claims that the group was not intent on committing violence or conducting an insurgency against the United States government.

Moscow Seems to Habitually Poison Dissenters

Posted on by

Novichok is a series of nerve agent weapons developed as part of a secret Soviet program and continued once the Soviet Union collapsed.

A Novichok nerve agent was used to poison the former Russian double agent Sergey Skripal in the English town of Salisbury in 2018. Also in 2018, British counterterrorism officials on Wednesday confirmed that two people found unconscious near the same site where a former Russian spy and his daughter were poisoned earlier this year were exposed to the same nerve agent, novichok, The Guardian reported.

British nationals Dawn Sturgess, 44, from Salisbury, and Charlie Rowley, 45, of Amesbury, were the victims reported by Scotland Yard.

PHOTO: Novichok nerve agent   The weapons were developed under a program known as “Foliant,” according to Mirzayanov. In the 1990s, he had been tasked with ensuring the secrecy of Russia’s chemical weapons program, but he decided to go public because he believed the program violated the country’s commitment to the Chemical Weapons Convention that it had signed along with the United States. More here.

NPR: Russian opposition leader Alexei Navalny, hospitalized in Berlin for several weeks after being poisoned, has been taken out of his medically induced coma.

In this August photo, Alexei Navalny poses for a photo with Siberian politician Ksenia Fadeyeva. Navalny was removed from a medically-induced coma in a Berlin hospital after suffering what German authorities say was a poisoning with a chemical nerve agent while traveling in Siberia in August. Andrei Fateyev/AP

In a statement Monday, Berlin’s Charité hospital said Navalny’s condition has improved and he is being weaned off mechanical ventilation. Navalny is responding to verbal stimuli, however, “it remains too early to gauge the potential long-term effects of his severe poisoning,” the hospital said.

The hospital only released details of Navalny’s condition after first consulting with his wife, who reassured doctors that Navalny would want that information released.

The 44-year-old politician, one of Russian President Vladimir Putin’s most prominent critics, became ill from poison on Aug. 20 during a domestic flight in Russia. Suspicion immediately fell on the Russian government, which has poisoned critics of the state before.

Two days later, Navalny was flown to Germany for treatment, where doctors put him into a coma. A German military laboratory confirmed last week that Navalny had consumed a variant of Novichok, a Soviet-era nerve agent, prompting the German government to demand a Russian investigation.

“There’s no doubt whatsoever” that Navalny’s poisoning was approved by the highest levels of Russia’s government, former CIA chief of Russia operations Steven Hall told NPR’s Mary Louise Kelly.

The U.K. summoned the Russian ambassador to the country Monday to express its “deep concern” over Navalny’s poisoning, First Secretary of State Dominic Raab said on Twitter. “It’s completely unacceptable that a banned chemical weapon has been used and Russia must hold a full, transparent investigation,” he said.

The Kremlin has dismissed accusations that it had anything to do with poisoning Navalny. “Attempts to somehow associate Russia with what happened are unacceptable to us, they are absurd,” Putin spokesman Dmitry Peskov said, according to the BBC.

***

Now the big question is what is the consequence to be against Russia and where will the United States, Britain or Germany be on this matter……crickets

SecState Pompeo to UNSC to Invoke Iran Snapback Sanctions

Posted on by

President Trump confirmed on Wednesday that he had asked Secretary of State Mike Pompeo to notify the UN Security Council that the U.S. intends to initiate “snapback” sanctions on Iran. The formal request is expected on Thursday, Israeli officials told Axios.

The backdrop: This move could create a diplomatic and legal crisis unlike any seen before at the Security Council. It comes days after the U.S. failed to mobilize support at the council to extend an international arms embargo on Iran.

The big picture: Despite having withdrawn from the 2015 Iran nuclear deal, the U.S. is invoking its terms in an attempt to force sanctions lifted under the pact to snap back into place.

  • The deal says any of the signatories — the U.S., Russia, China, France, Germany and the U.K. — can demand sanctions be reimposed automatically if they believe Iran has committed substantial violations. No country can veto such a move.
  • Russia and China contend that the U.S. gave up its right to reimpose the sanctions when it withdrew from the deal. That view is shared by others on the council, and even by John Bolton, the hawkish former national security adviser.
  • The U.S., on the other hand, claims it has the right to initiate the snapback mechanism because it is a party to the Security Council resolution that endorsed the nuclear deal and included the snapback mechanism.
  • The European signatories, who have tried desperately to save the nuclear deal, also oppose the U.S. move.

How it works: Pompeo is expected to arrive in New York on Thursday and present formal letters to the UN secretary-general and the UN ambassador from Indonesia, who holds the Security Council’s rotating presidency.

  • The letter will then be circulated to other members, beginning a 30-day consultation period.

What to watch: Israeli officials and Western diplomats both say they expect a major diplomatic crisis over those 30 days.

  • If any member of the Security Council submits a resolution to stop the snapback move, the U.S. will be able to veto it.
  • U.S. officials believe that the renewal of international sanctions will lead Iran to withdraw from the nuclear deal — and likely make it impossible for Democratic nominee Joe Biden to put the deal back together if he wins in November.
  • Israeli officials were notified on Monday that the Trump administration intended to submit the official complaint on Thursday.

The latest: “When the United States entered into the Iran deal, it was clear that the United States would always have the right to restore the UN sanctions that would prevent Iran from developing a nuclear weapon,” Trump claimed in a press conference on Wednesday.

*** UN crisis looms as US readies demand for Iran sanctions ...

For background and context:

In May of 2020 –

State Dept: The 13-year-old arms embargo on the Iranian regime will expire in October. The embargo was created by the United Nations Security Council but is scheduled to end because of the 2015 Iran nuclear deal, leaving the world’s foremost state sponsor of terrorism and anti-Semitism free to import and export combat aircraft, warships, submarines and guided missiles. To prevent this, the Security Council must pass a resolution to extend the arms embargo. If this effort is defeated by a veto, the Trump administration is prepared to exercise all legally available options to extend the embargo.

We face this circumstance because the Obama administration acceded to Iran’s demand that the U.N. embargo end in the fifth year of the deal. It is only one of many restrictions on Iran scheduled to expire over time. President Obama hoped concessions would moderate the regime’s behavior. “Ideally,” he said in 2015, “we would see a situation in which Iran, seeing sanctions reduced, would start . . . re-entering the world community [and] lessening its provocative activities.”

Instead, Iranian provocations accelerated under the nuclear deal. Emboldened by repeated diplomatic wins and flush with cash, the Iranian regime increased its ballistic-missile testing and missile proliferation to terrorist proxies. Iran built out a “Shiite crescent” in Syria, Iraq, Lebanon, Bahrain and Yemen, arming its proxies to the teeth.

The U.S. and partners have used the arms embargo to disrupt Iran’s sending advanced weaponry to terrorists and militants. This diplomatic tool has rallied the international community to interdict and inspect weapons shipments, building global condemnation of Iranian violations.

Among many examples, on Feb. 9, a U.S. Navy ship interdicted a ship attempting to smuggle Iranian weapons to Houthi rebels in Yemen. American sailors found 150 antitank guided missiles, three surface-to-air missiles, and component parts for unmanned explosive boats.

Iran’s President Hassan Rouhani sees a bright future when the embargo lapses. In November 2019, he said: “When the embargo . . . is lifted next year, we can easily buy and sell weapons.” He went on to hail the provision as a “huge political success” for Iran.

Kerry: Agreement on Iran issue only alternative to force ... John Kerry/Wendy Sherman negotiators of JCPOA

The regime plans to upgrade Iran’s aging air force, improve the accuracy of its missiles, and strengthen its ability to strike ships and shoot down aircraft. Iran’s Islamic Revolutionary Guard Corps—a terrorist group with a long history of targeting and killing Americans—could then reverse-engineer technologies in these systems for domestic weapons production and export.

Iranian weapons already put American and allied troops in the region under threat and endanger Israel. Letting the arms embargo expire would make it considerably easier for Iran to ship weapons to its allies in Syria, Hamas in Gaza, and Shiite militias in Iraq.

Mr. Rouhani understands the stakes. Last week he appeared on Iranian television to declare that “Iran will give a crushing response if the arms embargo on Tehran is extended.” This threat is designed to intimidate nations into accepting Iran’s usual violent behavior for fear of something worse.

The Security Council must reject Mr. Rouhani’s extortion. The U.S. will press ahead with diplomacy and build support to extend the embargo. We have drafted a resolution and hope it will pass. Russia’s and China’s interests would be served by a “yes” vote—they have more to gain from Mideast stability than from selling weapons to Iran for its sectarian wars.

If American diplomacy is frustrated by a veto, however, the U.S. retains the right to renew the arms embargo by other means. Security Council Resolution 2231 (2015) lifted most U.N. sanctions but also created a legal mechanism for exclusive use by certain nations to snap sanctions back. The arms embargo is one of these sanctions.

Mr. Obama explained how “snapback” works in 2015: “If Iran violates the agreement over the next decade, all of the sanctions can snap back into place. We won’t need the support of other members of the U.N. Security Council; America can trigger snapback on our own.” As of today, Iran has violated the nuclear deal at least five times.

The Trump administration’s preferred strategy is for the Security Council to extend the arms embargo while the U.S. continues to apply maximum economic pressure and maintains deterrence against Iranian aggression. Nearly 400 House members, an overwhelming bipartisan majority, have signed a letter backing Secretary of State Mike Pompeo’s diplomacy to extend the arms embargo. Iran certainly hasn’t earned the right to have it lifted. One way or another, the U.S. will ensure it remains in place against the violent and revolutionary regime in Tehran.

Now they Want a Trump Crimes Commission

Posted on by

Yup, both Congressman Eric Swalwell and Joy Reid of MSNBC are calling for a post Trump presidency Crimes Commission. Be careful what you ask for considering the work being done by AG Barr, John Durham and John Bash, not to mention the work of Senators Graham and Johnson. Timing is everything is Washington DC….lots to still be revealed. This comes on the heels of the Senate Intelligence (bi-partisan) report on Russia and the Trump campaign. Betcha, as Joy Reid refers to it, she hardly read it at all.

You gotta wonder if Reid or Swalwell have even considered ALL the crimes of the Obama administration or just a few of the Biden family clan….those from say Iraq or Ukraine or China.

How about this –>

The “U.S.-China Strong” group was founded to continue two Obama-era initiatives known as “100,000 Strong” and “1,000,000 Strong,” both of which sought to increase the number of Americans studying in China and introduce China-focused curricula into American schools.

The programs were promoted by the Obama-Biden administration despite valid concerns over Chinese Communist Party (CCP) sanctioned espionage, intellectual property theft, and propaganda.

Repeatedly praised by then-Vice President Biden, the initiative is no longer able to tap into U.S. tax dollars and now collaborates with a host of CCP-linked – and in some cases wholly-owned – entities including the Bank of China and Confucius Institutes. More here.

Joe Biden to Authoritarian Chinese President: U.S. Only ... source

But read on…

The Blaze reports: MSNBC host Joy Reid floated the idea of a potential future Biden administration establishing a “Trump Crimes Commission” to investigate President Donald Trump’s actions while in office — and perhaps even during his campaign, Mediaite reported.

Such a move would be unprecedented in American politics, as it is a longstanding norm that successors do not use their authority to investigate former political opponents.

Reid, an outspoken Trump critic, made the suggestion Tuesday night while discussing the final release of the bipartisan Senate report on Russian interference in the 2016 election with former Obama deputy national security adviser Ben Rhodes.

“It strikes me in just reading through this that Paul Manafort did to the United States what he had previously done to Ukraine,” Reid said. “He had messed with their elections in the past in order to put a [Russian President Vladimir] Putin puppet in charge. And now you have a president who is ruminating apparently on meeting with Vladimir Putin in New York, has talked about putting him back in the G7, and seems to be doing everything — you know, if there was a Christmas list that Vladimir Putin would have put together, it couldn’t have gotten any better than what Donald Trump is doing.

Reid is not the first to float such an idea. Journalist Andrew Feinberg and MSNBC legal analyst Glenn Kirschner have also called for a crimes commission to be empaneled, along with Democratic Rep. Eric Swalwell of California.

**

Rhodes, in response to Reid’s prompting, essentially agreed with the proposition but with a few caveats about how it would look and how it should be executed.

“There is no question in my mind, Joy, that there has to be an accountability process if Joe Biden wins, to protect the integrity of our democracy,” he said. “It’s not about getting revenge. It’s not about going after political opponents. That’s what Donald Trump does. It’s about sending a message that if you collude with, facilitate, coordinate with a foreign adversary and hacking private materials and releasing them that there are going to be consequences.”

He added: “We cannot just say we’re going to turn the page. We have to deal with this as a country. And so I really think it’s essential that we have some accountability process if Joe Biden wins the election.”

Hat tip to NSA FBI for Cracking Drovorub

Posted on by

The National Security Agency and the FBI are jointly exposing malware that they say Russian military hackers use in cyber-espionage operations.

Hackers working for Russia’s General Staff Main Intelligence Directorate’s 85th Main Special Service Center, military unit 26165, use the malware, which the Russians themselves call “Drovorub,” to target Linux systems, the NSA and FBI said Thursday in a detailed report.

The hackers, also known as APT28 or Fancy Bear, allegedly hacked the Democratic National Committee in 2016 and frequently target defense, government, and aerospace entities. The Russian military agency is also known as the GRU.

FBI e NSA descobrem novo malware Linux chamado Drovorub ...

While the alert does not include specific details about Drovorub victims, U.S. officials did say they published the alert Thursday to raise awareness about state-sponsored Russian hacking and possible defense sector vulnerabilities. The disclosure comes just months before American voters will conduct a presidential election.

“Information in this Cybersecurity Advisory is being disclosed publicly to assist National Security System owners and the public to counter the capabilities of the GRU, an organization which continues to threaten the United States and U.S. allies as part of its rogue behavior, including their interference in the 2016 U.S. Presidential Election,” the NSA and FBI said in the report.

The U.S. intelligence community has assessed that multiple foreign governments may “seek to compromise our election infrastructure.” It was not clear if the Russian hackers were using Drovorub malware in any ongoing interference efforts related to the 2020 presidential elections.

The NSA and FBI urged national security personnel, including the U.S. Department of Defense, to be on the alert for Drovorub attacks.

“The malware represents a threat because Linux systems are used pervasively throughout National Security Systems, Department of Defense, and the Defense Industrial Base,” the statement said. “All stakeholders should take action as appropriate.”

The announcement comes nearly one year after the NSA stood up a new cybersecurity directorate aimed at sharing more adversary threat intelligence with the public, and in recent weeks the NSA has worked to expose a spate of Russian campaigns, including Russian hackers’ efforts to target coronavirus research.

Senior Vice President of Intelligence at CrowdStrike, Adam Meyers, told CyberScoop the release shows these hackers are not easily deterred.

“Most importantly it demonstrates that FANCY BEAR has more tools and capabilities that are still being identified. This actor didn’t pack up and go home, they still have tricks up their sleeve,” Meyers told CyberScoop, adding that the news should raise alarm bells about Linux security. “Another important take away is that Linux is an area that organizations need to keep in mind from a malware perspective, many have not invested in similar security tools for this platform as they have for user platforms.”

Attacks employing Drovorub may be linked with previous Russian military efforts against connected devices, according to the NSA and the FBI. An APT28 attack that Microsoft security researchers identified last year against devices such as an office printer or a VOIP phone, for instance, was linked with an IP address that has also been used to access the Drovorub command and control IP address, the NSA and FBI said.

In such attacks, the hackers appeared interested in exploiting so-called internet of things devices in order to gain access to broader networks, other insecure accounts, and sensitive data, according to Microsoft.

The joint NSA and FBI release also has the effect of alerting the Russian government that U.S. officials are capable of tracking some of their work. The 780th Military Intelligence Brigade, which currently works with the Pentagon’s offensive cyber arm, Cyber Command, tweeted information out about the malware, and tagged a state-funded media outlet, RT, to flag the news for them.

The Drovorub malware consists of several components, the NSA and the FBI said, including an implant, a kernel module rootlet, a file transfer tool, and an attacker-controlled command and control server.

“When deployed on a victim machine, the Drovorub implant (client) provides the capability for direct communications with actor-controlled C2 infrastructure; file download and upload capabilities; execution of arbitrary commands as ‘root’; and port forwarding of network traffic to other hosts on the network,” the NSA and FBI said.

More detail for zdnet:

“Technical details released today by the NSA and FBI on APT28’s Drovorub toolset are highly valuable to cyber defenders across the United States.”

To prevent attacks, the agency recommends that US organizations update any Linux system to a version running kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement,” a security feature that would prevent APT28 hackers from installing Drovorub’s rootkit.

The joint security alert [PDF] contains guidance for running Volatility, probing for file hiding behavior, Snort rules, and Yara rules — all helpful for deploying proper detection measures.

Some interesting details we gathered from the 45-page-long security alert:

  • The name Drovorub is the name that APT28 uses for the malware, and not one assigned by the NSA or FBI.
  • The name comes from drovo [дрово], which translates to “firewood”, or “wood” and rub [руб], which translates to “to fell”, or “to chop.”
  • The FBI and NSA said they were able to link Drovorub to APT28 after the Russian hackers reused servers across different operations. For example, the two agencies claim Drovorub connected to a C&C server that was previously used in the past for APT28 operations targeting IoT devices in the spring of 2019. The IP address had been previously documented by Microsoft.