>* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Looks to me that someone despe

>* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Looks to me that someone desperately wants to implicate Russians or to make it seem that the attacker is Russian. Even the original Guccifer used Russian proxies (as per his Wikipedia entry). I also read on twitter that ")))" is a Russian version of a smiley face... they apparently omit ':' in ':)'. That version of the smiley face was used in his blog post. Again, that's definitely not a subtle clue. I hope someone runs linguistic forensic analysis on that whole blog post because the 'broken english' nature of it might reveal where the author could be from and what his mother tongue might be. People who are not native speakers of english make different mistakes based on what their mother tongue is so that's something that might be harder to manufacture. Broken english of a chinese speaker will be different from someone who speaks french, for example. I've also seen malware analysis reports which show that malware authors often change the locale of their computers and often insert variable names in different languages to further obfuscate the origin of malware. This is a fascinating case and it reads like a spy novel!