2 ms·
Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all
by strictnein 10y ago
Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.
- Bartweiss 10y agoAs I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.
- legacynl 10y agoThat is pretty flimsy, any other examples of those indicators?
- strictnein 10y agoI was just offering an example of another indicator, not that it was proof of anything by itself. Some technical indicators: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...