
The Global Intelligence Files,
files released so far...
1690
Index pages
by Date of Document
by Date of Release
2010-03-10
2011-03-05
2011-03-15
2012-01-29
2012-02-27
2012-02-28
2012-02-29
2012-03-01
2012-03-02
2012-03-03
2012-03-04
2012-03-05
2012-03-06
2012-03-07
2012-03-08
2012-03-09
2012-03-10
2012-03-11
2012-03-12
2012-03-13
2012-03-14
2012-03-15
2012-03-16
2012-03-17
2012-03-19
2012-03-20
2012-03-23
2012-03-25
2012-03-26
2012-03-27
2012-04-01
2012-04-02
2012-04-24
2012-04-26
2012-04-30
2012-05-10
2012-06-18
2012-06-20
2012-07-01
2012-07-24
2012-07-28
2012-07-29
2012-07-30
2012-07-31
2012-08-01
2012-08-02
2012-08-05
2012-08-06
2012-08-07
2012-08-08
2012-08-09
2012-08-10
2012-08-11
2012-08-12
2012-08-13
2012-08-14
Our Partners
Al Akhbar - Lebanon
Al Masry Al Youm - Egypt
Asia Sentinel - Hong Kong
Bivol - Bulgaria
Carta Capital - Brazil
CIPER - Chile
Dawn Media - Pakistan
L'Espresso - Italy
La Repubblica - Italy
La Jornada - Mexico
La Nacion - Costa Rica
Malaysia Today - Malaysia
McClatchy - United States
Nawaat - Tunisia
NDR/ARD - Germany
Owni - France
Pagina 12 - Argentina
Philip Dorling - Fairfax media contributor - Australia
Plaza Publica - Guatemala
Publica - Brazil
Publico.es - Spain
Rolling Stone - United States
Russian Reporter - Russia
Ta Nea - Greece
Taraf - Turkey
The Hindu - India
The Yes Men - Bhopal Activists
Sunday Star-Times - New Zealand
Community resources
courage is contagious
The Global Intelligence Files
On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.
Re: Notes on hacker infiltration on March 24th
Released on 2012-08-06 02:00 GMT
Email-ID | 364614 |
---|---|
Date | 2008-04-02 22:57:43 |
From | mooney@stratfor.com |
To | gfriedman@stratfor.com, burton@stratfor.com, greg.sikes@stratfor.com, fred.burton@stratfor.com, itteam@stratfor.com |
----- Original Message -----
From: "Fred Burton"
To: "Michael D. Mooney"
"George Friedman"
Cc: "IT Team"
Sent: Wednesday, April 2, 2008 3:49:04 PM GMT -06:00 US/Canada Central
Subject: RE: Notes on hacker infiltration on March 24th
Mike, Good work. Country of origin, if known? Thanks
----------------------------------------------------------------------
From: Michael D. Mooney [mailto:mooney@stratfor.com]
Sent: Wednesday, April 02, 2008 3:25 PM
To: Greg Sikes; Fred Burton; George Friedman
Cc: IT Team
Subject: Notes on hacker infiltration on March 24th
Hacker originated from 89-40-122-70.netlog.ro ( 89.40.122.70 )
He used what appears to be an exploit of the OpenSSH server to gain
access, this is difficult to prove.
He then proceeded to install a log cleaner that he used to clean up
evidence of his presence from standard log files, this was all canned
software, non-standard logfiles that showed his presence he did not notice
nor attempt to clean.
He then replaced the openssh application binaries with compromised
versions and finally installed and ran a bulk spam mailer that targeted a
variety of Italian email addresses.
I've included a source copy of the mail message he sent via the mailer:
--- Below this line is a copy of the message.
Return-Path:
Received: (qmail 21382 invoked by uid 1010); 25 Mar 2008 01:21:44 +0100
Received: from 66.219.34.36 by mta.frezza.net (envelope-from
(perlscan: 2.01st.
Clear:RC:0(66.219.34.36):.
Processed in 0.094448 secs); 25 Mar 2008 00:21:44 -0000
Received: from queue.stratfor.com (66.219.34.36)
by webmail.frezza.net with SMTP; 25 Mar 2008 01:21:43 +0100
Received: by queue.stratfor.com (Postfix, from userid 0)
id 46E5A4C281B7; Mon, 24 Mar 2008 19:10:19 -0500 (CDT)
To: cerca@titoli.it
Subject: Avviso di Sicurezza
From: mail@QuiUBI.it
Content-Type: text/html
Message-Id: <20080325001019.46E5A4C281B7@queue.stratfor.com>
Date: Mon, 24 Mar 2008 19:10:19 -0500 (CDT)
X-Qmail-Scanner-2.01st: added fake MIME-Version header
MIME-Version: 1.0
![]() |
Times, serif size=3>Gentile Nell'ambito delle misure di sicurezza da noi adottate, Per Se, Cordiali saluti, |
---------------------
Further info the IP address he originated from:
% Information related to '89.40.112.0 - 89.40.127.255'
inetnum: 89.40.112.0 - 89.40.127.255
netname: SC-NETLOG-COMPUTER-SRL
descr: SC NETLOG COMPUTER SRL
descr: CONSTRUCTORUL Bl.10, Sc.2, Ap.12
descr: PETROSANI HUNEDOARA
country: ro
admin-c: IC1385-RIPE
tech-c: IC1385-RIPE
status: ASSIGNED PA
remarks: Registered trough http://www.jump.ro/ip.html
mnt-by: RO-MNT
mnt-lower: RO-MNT
mnt-routes: NETLOG-MNT
source: RIPE # Filtered
person: Istvan Csont
address: SC NETLOG COMPUTER SRL
address: STR. CONSTRUCTORUL BL.10, AP. 12
address: Hunedoara Petrosani RO
address: Postal Code: 1234
address: Registration/ID Number: J40/240/20.02.2004
address: Fiscal Code: 16162700
phone: +40-720-721700
fax-no: +40-354-401240
e-mail: istvan@netlog.ro
nic-hdl: IC1385-RIPE
mnt-by: NETLOG-MNT
source: RIPE # Filtered
% Information related to '89.40.112.0/20AS41950'
route: 89.40.112.0/20
descr: SC NETLOG COMPUTER SRL
origin: AS41950
mnt-by: NETLOG-MNT
source: RIPE # Filtered
--
----
Michael Mooney
mooney@stratfor.com
AIM: mikemooney6023
mb: 512.560.6577
--
----
Michael Mooney
mooney@stratfor.com
AIM: mikemooney6023
mb: 512.560.6577