LePen & Macron in runoff after 1st round of elections in France

AUDub said:

https://motherboard.vice.com/en_us/...russian-hackers-fancy-bear-to-macron-phishing

Also, Cyrillic text in the metadata.

https://cdn.jpg.***/futurico/c8/8b/1494066935-c88b59d5739fcbd127dfb31c53e81391.jpeg

Click to expand...

Tide1986 said:

What does the dc:creator tag mean? It points to a French name.

Click to expand...

AUDub said:

https://motherboard.vice.com/en_us/...russian-hackers-fancy-bear-to-macron-phishing

Also, Cyrillic text in the metadata.

Click to expand...

CharminTide said:

Not even trying to hide it.

Click to expand...

AUDub said:

https://motherboard.vice.com/en_us/...russian-hackers-fancy-bear-to-macron-phishing

Also, Cyrillic text in the metadata.

https://cdn.jpg.***/futurico/c8/8b/1494066935-c88b59d5739fcbd127dfb31c53e81391.jpeg

Click to expand...

Tidewater said:

Georgi Petrovich Roshka, by the way.

Click to expand...

Many noted that all of the documents in one of the smaller archives released yesterday (xls_cedric) appeared to have been edited over a 4 minute period on the 27th of March.
These were edited by a Russian language version of Microsoft Excel. About half recorded a user named "Рошка Георгий Петрович / Roshka Georgy Petrovich" performing the edits.
It's suspicious that these documents, some which were created over ten years ago, were all edited so recently during the same 4 minutes. It suggests the edits may be following their theft, not before.
Before linking any individual to these attacks though it's important to note:

• A number of people have that name;
• This could be false information planted by the attackers; or
• An entirely innocent employee at a bank somewhere has been unfortunate enough to get caught up in this.

Similar previous mail dumps have included a mix of real and fake information, and the Macron campaign have also said that the dump is a mix of real and fake documents. It's important to keep that in mind – particularly when you see e-mails in the dump suggesting that politicians have bought drugs online.

Click to expand...

The name of Russian specialist was found in the metadata of nine of the files dumped by Wikileaks and Australian “journalist” Julian Assange.


The original author of the documents, as the metadata indicates, was cooperative of the Macron’s campaign headquarters Mr. Serdik 0, but later information in the file’s property was changed into Georgi Roshka. A man whose name is Georgi Petrovich Roshka is employed by the Russian company “Eureka” involved in the cyber security area. The Russian Ministry of Foreign Affairs, Ministry of Defense and intelligence agencies are customers of Eureka.
On May 5th Wikileaks and “journalist” Assange published stolen personal documents and correspondence of a leading candidate in French Presidential elections Emmanuel Macron. Assange made available about 9GB of photos, scans and other electronic documents dated to April 24th, 2017.
The Macron’s campaign informed that hackers broke into their servers a week ago, but warned that there are forged documents among real files.
Japanese company Trend Micro confirmed that the hackers who attacked Macron’s campaign are Pawn Storm group, an infamous Fancy Bear and APT28. This is the same group of hackers that conducted attacks against other Western countries, including against the Democratic Party in the United States. Hackers provided stolen files to Wikileaks, an a para-criminal organization founded by “journalist” Assange, who has been unwilling to discuss his activities with the international investigators and hide himself in the Embassy of Ecuador in London.

Click to expand...

TIDE-HSV said:

The timing of the attack is fascinating. I think that the Russians were trying to take advantage of the mandatory "quiet" period required by French law, believing that would keep the Macron campaign from responding. They were also, I think, trying to take advantage of social media, just as they did in the US. It looks like the response they got from the French public was a massive yawn...

Click to expand...