Moon of Alabama Brecht quote
November 09, 2018

ISIS Again Claims Cyber Attacks Which Were Falsely Blamed On Russia

Since late 2014 the Islamic State in Iraq and Syria (ISIS) had its own hacking group. It waged cyber attacks against media and military targets. The group became known as United Cyber Caliphate (UCC).

Later on some "experts" attributed the UCC attacks to Russia. They claimed that the Cyber Caliphate did not exist but was a Russian false flag operation. There is now new evidence such claims are nonsense.

The attacks claimed by the Cyber Caliphate included:

  • Jan 2015 - Twitter and Youtube account of the U.S. CentCom taken over and filled with pro-ISIS messages.
  • Mar 2015 - United States Air Force's pilots list with detailed personal information posted online.
  • Apr 2015 - French TV5Monde live feed and social media hacked and defaced with the message "Je Suis ISIS".
  • Apr 2015 - Australian airport website defaced with ISIS message.
  • Aug 2015 - United States' military database hacked and data of some 1400 personnel posted online.
  • Sep 2015 - British government emails hacked. Email addresses of top cabinet ministers published.
  • Apr 2016 - UCC successfully hacks 20 Australian business websites, redirects them to ISIS content.
  • Apr 2017 - UCC released a kill list of 8,786 people.

ISIS delivered flawless propaganda material with well edited videos and created its own glossy magazines. Producing these required computer expertise. It was thus not astonishing to learn that some hackers had joined ISIS and worked with its media team. From an ISIS perspective the above listed targets all made sense. There was no reason to doubt the ISIS claims.

But then the 'Russia scare' nonsense took over. Suddenly each and every assumed computer attack, including those by the Cyber Caliphate, were attributed to Russia:

Russian hackers linked to the Kremlin could be behind one of the biggest attacks to date on televised communications, which knocked French station TV5Monde off air in April, sources familiar with France’s inquiry said.
Hackers claiming to be supporters of Islamic State caused the public station’s 11 channels to temporarily go off air and posted material on its social media feeds to protest against French military action in Iraq.
U.S. cybersecurity company FireEye, which has been assisting French authorities in some cases, said on Wednesday that it believed the attack came from a Russian group it suspects works with the Russian executive branch.
Information about the TV5 attack was published on a website branded as part of the “Cyber Caliphate,” a reference to the Islamic State.

But the site was hosted on the same block of Internet Protocol addresses and used the same domain name server as the group called APT28 by FireEye and Pawn Storm by Trend Micro, another large security company.

Similar claims were made over other attacks that ISIS claimed for itself. "The Russians did it!" screamed various snake-oil selling cyber security companies.

Soon it was said that the Cyber Caliphate did not exist at all:

[T]he Cyber Caliphate is a Russian intelligence operation working through what spies term a cut-out.

U.S. secret agencies, including the National Security Agency, which controls American cyber-espionage and works closely with CYBERCOM, came to similar conclusions "APT 28 is Russian intelligence, it’s that simple,” explained an NSA expert to me recently.
In other words, the Cyber Caliphate is a Russian false-flag operation.

The snake-oil sellers and the writer above (intentionally) mistake methods for actors. The Advance Persistent Threat (ATP) number 28 describes a certain course of action taken during a hack. It is well know method that can be identified to some degree. But recognizing a method does not identify the persons that use it.

If a burgler once used a crowbar to open a window, further nearby break-ins that use a similar method might have been done by the same person. Or they might not. A different burgler could have used the same method. A home owner could have used it to scam his insurance. The method does not describe the actor.

Likewise the use of certain tools and methods to break into a computer does not define an actor. ATP 28 is not Russia. These tools and methods are publicly known. A spearphishing email is send to the target. When the receiver clicks a link in that email a malicious software is launched that creates a backdoor into the targeted computer. Anyone can find such tools online and initiate an attack. The often claimed attribution of ATPxyz to Russia always was and is sheer nonsense.

There is also new proof that the Cyber Caliphate indeed exists.

A few days ago a news outlet affiliated with ISIS published an obituary of a Canadian hacker who worked for ISIS. The Montreal Gazette reports:

An Islamic State-linked media outlet says a Canadian man was behind the terror group’s highest-profile cyber attacks, including the embarrassing takeover of the Twitter account of the U.S. military’s Central Command.
The Canadian fighter, who is said to have been killed by a drone strike in Syria, also allegedly penetrated bank computers and used the “spoils” to fund their fighting and hacked the U.S. Department of Defense, airports, international media organizations and the accounts of “hundreds” of U.S. soldiers.
The Toronto-born man “managed to bring blessed victories for the Caliphate state by carrying out electronic attacks that have made the enemies taste defeat and failure,” according the [Arabic-language] notice, ..

The “martyrdom” notice published by Al-Muhajireen Foundation, an outlet with known links to ISIL, identifies the Canadian jihadi hacker only by a nickname: Abu Osama Al-Kanadi.
The announcement says Al-Kanadi became a top computer specialist with ISIL, also known by the acronym ISIS, and praises his online exploits with the Caliphate Cyber Army.

Abu Osama Al-Kanadi does not sound Russian to me. Nor were any of the hacks the Cyber Caliphate claimed in anyway useful to Russia.

But the damage is done. None of those "experts" who claimed that Russia was behind the Cyber Caliphate attacks will retract their claims and papers.  Nor will there be any correction in those main stream media that repeated their nonsense.

The message is clear: Russia is bad. Every hack ever done is by Russia. Russia is the enemy. Don't you ever forget that.
h/t Stephen McIntyre

Posted by b on November 9, 2018 at 20:33 UTC | Permalink | Comments (44)

November 08, 2018

Two 'Russian Influence' Campaigns Claim Victory - One Is Real, The Other One Fake

Two new 'Russian' campaigns claim victory in their disinformation acts against the 'west'. One is real and the other one is fake. But - as usual by now - 'western' media mistake one for the other. For them the real one is fake and the fake one real*.

Proud Bear, a collective of GRU spies, celebrates its success in arranging Britain's exit from the European Union. It rented billboards in London to claim victory.





Last night the GRU agents launched their @Pr0ud_Bear Twitter account and their webpage to proudly confess their deed and to celebrate success.

Putin riding Brexit bulldog Arron Banks - video

The GRU officers ask for donations. They want to rent the animated billboard at Waterloo Station to show the real man behind Brexit. A bare breasted Putin "taking back control" while riding Big Ben with the Russian flag flying on top of it.

(photoshopped) bigger

The billboard rent for two weeks is £55,000 of which, as of now, £1,206 have been raised.

In a press notice the 'GRU Informatsiya Directorate' notes:

"The group hopes to counter recent unwarranted negative publicity about the GRU by putting up advertisements highlighting their part in Britain’s imminent liberation from the EU.”

The British disinformation agency Reuters calls the GRU billboards "spoof" and the GRU campaign a "stunt". That is disingenuous. Proud Bear is certainly more real then the Novichok poisoning of the now vanished Skripals and more real than the 'hacking' of the DNC servers blamed on Fancy and Cozy Bear.

Hidden in the source code of the Proud Bear website (in Firefox: "view-source:") is a meta text written in Russian. It begins (machine translated):

Financing Proud Bear is fully secured by the proceeds from the sale of giant eggplants grown on offshore land in Panama and watered solely with tears of Georges Soros.
But seriously, all of us are volunteers and are engaged in this project only because we are really concerned about the state of health of our democracy and the fact that not one of our leaders and a very small number of active politicians show any readiness to move their goals and protect her.

We know about the existence of Putin’s political machine aimed at destabilizing our society. We see its methods aimed at provoking discord and inciting nationalist enmity. And yet, those in power are in no hurry to respond. The 2016 referendum on UK membership in the European Union is an excellent example of such sabotage. The sea of ​​evidence that Russia had a hand in one of the most significant political decisions of our generation is simply ignored by our government. Theresa May prefers to promote Brexit’s ridiculous plan instead of stopping for a moment and truly investigating the question of whether Russia's influence was really decisive in the vote. The UK immediately needs a Muller-style investigation into Russian intervention in the Brexit campaign.

The British government denies that Russia had any influence in the Brexit campaign. That is not astonishing. Real GRU operations are executed flawlessly and stay secret until they are intentionally revealed. It did simply did not see the Russian hands behind it.

The hidden message goes on to lament about Russian and western campaigns to "destabilize democratic regimes" and lauds Russian journalists for revealing "the corrupt and antidemocratic nature of power in Russia."

That sounds like a typical GRU faint. Mirrors behind mirrors. In their hidden statement the Proud Bear agents play British victims while being the Russian source of the influence campaign that led to Brexit.

The Daily Beast is more inclined then Reuters to believe in the truth of the Russian menace.


It claims that the Russian Internet Research Agency in St.Petersburg is celebrating its great success of manipulating the U.S. midterm elections:

The Mueller-indicted Russian troll farm known as the Internet Research Agency is apparently declaring victory in the U.S. election and warning the “citizens of the United States of America” that “your intelligence agencies are powerless.”

“Despite all their efforts, we have thousands of accounts registered on Facebook, Twitter and Reddit spreading political propaganda,” read a statement attributed to the St. Petersburg-based organization. “These accounts work 24 hours a day, seven days a week to discredit anti-Russian candidates and support politicians more useful for us than for you.”

The statement appeared on a website titled the “Internet Research Agency American Division” that popped up over the weekend. Featuring a clip art logo of a green goblin typing on a laptop, and packed with absurd boasts about the IRA’s prowess, the site at first appeared to be a lampoon. But on Tuesday night it posted a previously unseen list of 100 IRA Instagram accounts that Facebook confirmed as authentic.

The unnamed website found 100 Instagram accounts that were "authentic"? Who knew that any such exist?

The website, which the Daily Beast does not dare to name, is BBC Russia took a look at it and also seems to believe (machine translation) that the IRA is behind it.

The Instagram accounts listed on the site, for example, are - as of now - all dead. Facebook claims that it already deleted many of the named accounts before the website went up. (Immi.great though is also a Youtube account of Dmajan Denoble, a legitimate lawyer who gives immigration advice.)

But how can Dana Rohrabacher, the most pro-Russian representative, lose in the midterm election if the Russians influenced it?

To me the site seems fake. A spoof or stunt created to further defame the Russian web company which the Muller investigation accused of selling advertisement space on the inspiring web- and Facebook pages it built for that purpose.

It is possible that the Atlantic Council's DFRLab created the site to promote its censorship campaign? Quite so.

Proud Bear though is real. Russia is always proud to parade its troops (vid) when it celebrates victory. Britain is in political chaos over Brexit. The GRU won. It comes out into the open, offers vodka and celebrates it.

That's how its done. Nastrovje!

*Note: The above may contain traces of snark.

Posted by b on November 8, 2018 at 22:17 UTC | Permalink | Comments (79)

November 07, 2018

A Short Take On The Midterm Elections

The midterm elections in the United States had mixed results. Both sides will claim victory. There was no landslide in either direction.

The Republicans extended their majority in the Senate while the Democrats took the House of Representatives.

My hunch, that the Republicans would keep a majority in the House, was wrong. I underestimated the turnout for the Democrats. Some 114 million people voted yesterday compared to 88 million in the 2014 midterms.

The Democrats won at least 26 additional seats in the House. They needed 23 seats to gain a majority. Republicans increased their majority of 51 seats in the Senate to at least 54 seats.

The Democrats will chair all House committees and will run dozens of investigations against President Trump and his administration. They will subpoena his tax records, launch more 'Russian collusion' investigations and will question the ethics of Trump administration members. It will be a lot of political theater with little value. With a solid Republican majority in the Senate there is no chance that Trump will be impeached.

Trump's domestic agenda will be hindered by the new House majority. He may well compensate for that with a more aggressive foreign policy.

With more than $5 billion spent on midterm election campaigns the elected people are more indebted to their rich donors than ever before.

Florida passed an amendment that will restore the voting rights of some 1.4 million people with past felony convictions. This will change the political landscape. Most of the felons are people of color, often convicted for very minor crimes. In 2016 Trump carried the state by 100,000 votes.

Brothel owner Dennis Hof, who died on October 16, defeated Democrat Lesia Romanov and wins a Republican seat in the Nevada state assembly.

The campaign for the 2020 election has begun.

Posted by b on November 7, 2018 at 8:04 UTC | Permalink | Comments (199)

November 06, 2018

Open Thread 2018-59

News & views ...

Posted by b on November 6, 2018 at 18:18 UTC | Permalink | Comments (133)

November 05, 2018

This NYT Cartoon Helps Trump To Win

The New York Times cartoonist claims that:

  • Protecting U.S. borders from illegal entry by foreigners is not a valid mission for the U.S. military.
  • Illegally invading and destroying countries in the Middle East, to the benefit of the Zionist entity, is a valid mission.


It is highly doubtful that U.S. voters agree with that take. Most of them seem to believe in the "Defense" moniker of the War Department.

Cartoons like the above can only help Trump win the midterm elections. One wonders why the NYT is willingly playing into his hands with this.

Posted by b on November 5, 2018 at 12:44 UTC | Permalink | Comments (174)

November 03, 2018

The MoA Week in Review - OT 2018-58

Last week's posts on Moon of Alabama:

The SDF is very much in trouble. ISIS is still attacking. There is trouble between the locally recruited Arab footsoldiers of the SDF and the Kurdish command. The U.S. is again bombing but the defense front of the SDF has largely broken down.

The UAE and its mercenaries have renewed a large attack on Hodeidah. Should they capture it they will control all supplies to the Houthi areas. The Saudis and the UAE seem to use the 30 days Trump has given them for maximum gain.

Use as open thread ...

Posted by b on November 3, 2018 at 14:19 UTC | Permalink | Comments (195)

November 02, 2018

The Film The Israel Lobby Doesn't Want You To See

Today The Electronic Intifada published the first two parts of "The Lobby – USA", a four-part undercover investigation by Al Jazeera into Israel’s covert influence campaigns in the United States.

The planned broadcast of the film was prevented by Qatar, which owns Al Jazeera, on behalf of Israel.

From EI's description:

To get unprecedented access to the Israel lobby’s inner workings, undercover reporter “Tony” posed as a pro-Israel volunteer in Washington.

The resulting film exposes the efforts of Israel and its lobbyists to spy on, smear and intimidate US citizens who support Palestinian human rights, especially BDS – the boycott, divestment and sanctions movement.

It shows that Israel’s semi-covert black-ops government agency, the Ministry of Strategic Affairs, is operating this effort in collusion with an extensive network of US-based organizations.

These include the Israel on Campus Coalition, The Israel Project and the Foundation for Defense of Democracies.

It is amazing that Israel gets away with such spying and intelligence operations against U.S. citizens and within the United States.

Israel and its lobby did a lot to suppress the movie and its wider distribution. That can only mean that it is good and deserves a large viewership.

Watch it here.

Posted by b on November 2, 2018 at 19:28 UTC | Permalink | Comments (61)

November 01, 2018

By Way Of Deception - False Flag Terror Acts Press Europe To Sanction Iran

Israels secret service Mossad, with the CIA behind it, is framing Iran with alleged assassination plots in Europe.

In September a terror attack killed some 30 people in Iran. Two entities, an Arab separatist movement as well as the Islamic State terror group ISIS, took responsibility. After an investigation Iran found that it was ISIS which was responsible. It took revenge against the identified culprits.

Six weeks later Denmark claims, without providing evidence, that Iran tried to assassinate a leader of the Arab separatist movement over the incident. Iran denies any such attempt. The right wing Danish government uses the claim  to urge other European countries to sanction Iran.

It is unlikely that Iran would take action in Europe, which it urgently needs to reduce the damage of U.S. sanction, over an incident for which it already punished the Islamic State.

The Danish claims are allegedly based on information provided by Mossad. That only increases the suspicion that the assassination plot is a false flag operation similar to a recent one in Belgium. More likely though is that the CIA is behind such false flag incidents.

The details:

On September 22 gunmen killed 29 and wounded more than 70 participants and onlookers of a veterans day parade in Ahvaz, Iran:

Three of the attackers were gunned down during clashes with the security forces and one other was arrested, news agencies reported.
"The terrorists disguised as Islamic Revolution Guards Corps (IRGC) and Basiji (volunteer) forces opened fire to the authority and people from behind the stand during the parade," the governor of Khuzestan, Gholam-Reza Shariati, said, according to IRNA.

U.S. State Department spokeswoman Heather Nauert also referred to the attack as terrorism. Nauert said on Saturday, "We stand with the Iranian people against the scourge of radical Islamic terrorism and express our sympathy to them at this terrible time".

The Islamic State as well as an Arab separatist movement claimed responsibility:

On 22 September 2018, Yaqoob Al-Ahvaz claimed responsibility for the 2018 Ahvaz military parade attack in comments to UK-based Iran International TV. He said that his group Ahvaz National Resistance, a part of Arab Struggle Movement for the Liberation of Ahvaz, has "no choice but to resist." On 23 September, a statement made in The Hague, Netherlands, on the ASMLA website, denied responsibility for the attack, saying that the claim was made by a "group that was expelled from the organization since 2015."

After Yaqoob Al-Ahvaz claimed responsibility Iran accused Saudi Arabia of involvement in the attack:

IRGC spokesman Ramezan Sharif said the attackers were affiliated with a terrorist group supported by Saudi Arabia, Iran's state-run Press TV said.

"The individuals who fired at the people and the armed forces during the parade are connected to the al-Ahvaziya group which is fed by Saudi Arabia," Sharif said. Saudi Arabia has yet to respond to the allegations.

The UK-based Iran International TV, where Yaqoob Al-Ahvaz claimed responsibility, is funded by a firm with ties to Prince Mohammed bin Salman.

Several years ago ASMLA aka Al-Ahvaziya committed several terror attacks in Iran. Its leaders live in the Netherlands and Denmark.

Iran immediately reminded those countries of their duties:

Iran's Foreign Ministry summoned the ambassadors of the Netherlands and Denmark, along with a senior British diplomat on Saturday to issue a strong protest the attack, Iran's state-run media reports.

Bahram Ghasemi, Iran's Foreign Ministry spokesman, said Iran "re-emphasized" to the diplomats a previous warning about the presence in their respective countries of members of a group that Iran classifies as a terrorist group and wants arrested and prosecuted.

According to IRNA, Ghasemi said "it is unacceptable" that members of a terrorist group be allowed in those countries and not be included on the European Union's terror list only because they have not committed crimes on European soil.

A few days later though, Iran concluded that the attack was not committed by the Ahvaz movement, but by the Islamic State. On October 1 it responded with a missile salvo that hit Islamic State facilities in Syria:

The Iranian Revolutionary Guards Corps (IRGC) announced they have bombed a site in eastern Syria in retaliation to the terrorist attack against a military parade in Iranian Ahvaz 10 days ago.
The IRGC confirmed that the targeted terrorist group was behind the terror attack that killed over a dozen and injured many more in the city of Ahvaz.

An additional operation against the planers of the attack took place on October 15 in Iraq:

Iran’s Revolutionary Guards said on Tuesday they had killed the “mastermind” behind an attack on a military parade in the Iranian city of Ahvaz last month which left 25 people dead, nearly half of them members of the Guards.

The Guards said in a statement published on state media their forces had killed a man named Abu Zaha and four other militants in Diyala province in Iraq. One news website run by Iran’s state television said Abu Zaha was a member of Islamic State.

That closed the issue for Iran.

On October 30 Denmark suddenly accused Iran of an assassination plot against a leader of the ASMLA group:

Danish Prime Minister Lars Lokke Rasmussen described the alleged planned assassination by Iran of an exiled separatist leader in Denmark as "totally unacceptable"

The Iranian ambassador to Copenhagen was summoned to the foreign ministry over the allegations.

A Norwegian citizen of Iranian origin was arrested in Sweden on 21 October in connection with the alleged plan. The man denies the charges.

Authorities conducted a massive manhunt on 28 September which led to road closures, trains and ferries being cancelled, and bridges being shut across Denmark.

On Tuesday, Danish intelligence chief Finn Borch Andersen confirmed the measures had been taken to prevent the alleged plot.

The Danish intelligence accused the Norwegian citizens of taking pictures of a house where one of the ASMLA leader lives. It provide no evidence for its claims.

Iran rejected the accusations:

An Iranian foreign ministry spokesman said such "biased reports" and allegations pursued "the enemy's plots and conspiracies" to harm the developing relations between Iran and Europe, according to Tasnim news agency.

It indeed seems that Danish government, led by the rightwing Venstre party, is collaborating with the U.S. and Britain to sabotage the European position against U.S. sanctions on Iran:

Mr Rasmussen said, after a meeting with his British counterpart Theresa May in Oslo, that he appreciated her support.

"In close collaboration with UK and other countries we will stand up to Iran," he tweeted.

Foreign Minister Anders Samuelsen said Denmark would discuss further actions with European partners in the coming days.

The US Secretary of State, Mike Pompeo, congratulated Denmark on arresting "an Iranian regime assassin".

The former Secretary General of NATO and U.S. stooge Anders Fogh Rasmussen is the predecessor of the current Venstre party leader and Danish premier Lars Løkke Rasmussen. Both are hawks.


Yesterday Israeli journalist reported that the information on which Denmark acted came from Israel:

Barak Ravid @BarakRavid - 10:12 utc- 31 Oct 2018

BREAKING: Israeli Mossad gave Danish Security and Intelligence Service (PET) the information about the assassination attempt planned by Iranian intelligence service against the leader of the Iranian opposition organization ASMLA, Israeli official tells me

Well - if Israeli officials says Iran did something bad that will surely be true. (Not.)

Iran's foreign minister accuses Israel of running false flag operations to frame Iran:

Javad Zarif @JZarif - 20:15 utc - 31 Oct 2018

Mossad's perverse & stubborn planting of false flags (more on this later) only strengthens our resolve to engage constructively with the world. [...]

The Times of Israel notes:

Denmark’s accusations against Iran followed the unveiling of another suspected Iranian plot to target a Paris rally by an opposition group in June. According to Israeli reports, the Mossad helped thwart that attack as well, which led to the arrest of several Iranians in Europe, including a diplomat.

The earlier plot involved two members of the anti-Iranian terror cult MEK in Belgium who were caught with explosives that they allegedly wanted to use to blow up a MEK conference in Paris:

The allegation that an Iranian operative plotted an attack on French soil is jeopardizing Europe’s support for the accord. As U.S. and Israeli officials ramp up pressure on Europe to sever ties with Tehran, they have cited it as a reason why Mr. Macron and other leaders should end their support for the deal.

On Tuesday, Denmark announced it had foiled an Iranian operation to kill a dissident, turning up the pressure on Europe to harden its posture toward Tehran. A spokesman for Iran’s foreign ministry said Iran had no involvement in the case.

The most interesting question about such plots is always "Cui bono?". Who benefits from these incidents?

Iran has no interest in causing any upheaval with Europe shortly before the second round of U.S. sanctions, which threaten its economic well being, come into place early this month. Iran already took revenge for the Ahvaz attack. It has no need to tackle some unrelated separatist who resides in Denmark. Iran needs Europe to work around the U.S. sanctions. That aim prohibits any such operations.

Both, the MEK plot as well as the case in Denmark, smell of false flag incidents. In both case no one was hurt. In both cases some stooges with no current relation to Iran were caught. Both cases came to light after information was allegedly provided by Mossad.

But is it really Israel who set up these incidents? Both serve U.S. interest just as much. It is no secret that the U.S. wants to prevent European subversion of U.S. sanctions on Iran.

In June 2017 the Trump administration installed a new CIA group to plot and launch undercover operations against Iran. It is led by its most ruthless operator:

He is known as the Dark Prince or Ayatollah Mike, nicknames he earned as the Central Intelligence Agency officer who oversaw the hunt for Osama bin Laden and the American drone strike campaign that killed thousands of Islamist militants and hundreds of civilians.

Now the official, Michael D’Andrea, has a new job. He is running the C.I.A.’s Iran operations, according to current and former intelligence officials, an appointment that is the first major sign that the Trump administration is invoking the hard line the president took against Iran during his campaign.

Mr. D’Andrea’s new role is one of a number of moves inside the spy agency that signal a more muscular approach to covert operations under the leadership of Mike Pompeo, the conservative Republican and former congressman, the officials said.

A year later the same Mike Pompeo, now Secretary of State, created the Iran Action Group within the State Department. It is a complementary entity to the CIA group. Little has been published about the action both groups have taken so far. What has Ayatollah Mike done since he set up shop 18 month ago?

It is likely that the false flag operations in Europe, like the ones in Belgium and Denmark, are run by the CIA with the Mossad only in an auxiliary role. The U.S. can hardly admit that it is faking terrorist incidents in Europe while the overrated Mossad loves to take credit for everything that happens on this world. 

Europe has no interest in supporting or escalating Trump's war on Iran. EU countries should demand hard evidence from Denmark and other accusers of Iran and should not act on the basis of only vague accusations.

Posted by b on November 1, 2018 at 14:30 UTC | Permalink | Comments (93)