In the past they have texted specific GRU agents on their personal phones: https://www.wired.com/story/cyber-command-ira-strike-sends-s...

> As The New York Times reported last October, Cyber Command operators sent direct messages to individual Russian staffers that they had identified as involved in election interference, and were tracking their activity. The Post reports that the IRA was troubled enough by those messages that they launched an internal investigation to identify potential leakers.

I have a feeling that the US and allied countries are pretty deep into the Russians with this stuff.

IRA is not GRU

lol.

?

The difference between the government, the corporate sector (oligarchy) and the mafia in Russia is nominal. It's all the same people, operating out of different organizational fronts.

It's a super-organization that transcends what we think of elsewhere as being different sectors (of varying degrees of legality)

There's a big difference between the GRU and the SVR and the FSB. There's an even bigger difference between GRU and the IRA.

These are completely different things, it's downright silly to imply otherwise.

IRA staffers certainly aren't "GRU agents"

I don't disagree with anything you say.

But nothing you say argues against what I said.

It's often through a single mistake made once that allows you to link some pseudonymous profile to a real person. For example, I recall reading about a particular case where some command&control server was identified and being monitored, and once one of the operators accidentally logged in to his personal profile on a social media site over the 'secure VPN' connection.

Also, there have been cases where authorities have been 'subcontracting' certain services or tools from local cyber criminals working on online financial fraud - where those criminals were later arrested abroad, and have agreed to testify against their former partners/employers.

Sometimes you catch them on camera https://apnews.com/article/ef3b036949174a9b98d785129a93428b

Counter intelligence operations ran by NSA and CIA. They most likely have compromised infrastructure used by the attackers. At the end of the day, Russian cyber ops are still a governmental organization - which means they keep records, have JIRA (or similar) tickets, logs of work to support promotions, etc.

CIA likely has human assets within the ranks of the military intelligence units that could provide information or details of written documents.

I’ve assumed the use something outdated like paper orders, but yes, there might be some sort of a ticket «kill Navalny» that has gone through some interesting states and comments.

By detractors? By cyberattacks? Good old espionage?

they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.).

also google location services might have some data on them too

HUMINT probably.

The Dutch secret service MIVD caught a couple of GRU "diplomats" who were trying to do MITM (with a Pineapple) on e.g. the organisation in The Hague who were investigating MH17. One even had a taxi receipt with him from GRU HQ to Moscow airport.

Meanwhile, the Dutch secret service AIVD had access to GRU HQ camera feeds.

Before all that happened a high ranking Russian police officer got reprimanded (IIRC send to gulag) for working together with the Dutch police on high level cyber crime.

what kind of taxi receipt shows the pick up point?

has his name and signature on it. i guess he kept it to expense the $10. a bit too convenient. if true, it means this guy is a spy carrying a ticket in his pocket that says "i spy for russia". he is so bad at his job that we have nothing to worry about

Theory has it it was a routine job for them, hence the complacency.

I have wondered about the same.

I didn't even see them point out which one was "Guccifer 2.0"

Thats probably the real interesting story here...