3) Gosh, I wonder what outlet Russian intelligence is going to use to launder these stolen documents.pic.twitter.com/4zjF7tXySL
When you tweet with a location, Twitter stores that location. You can switch location on/off before each Tweet and always have the option to delete your location history. Learn more
14) Tldr: this "lone hacker" uses many VMs, speaks Russian; username is founder of USSR secret police & likes laundering docs via Wikileaks.
15) Spot the difference: Left: doc sent to Gawker (page 210). On right, same page in https://guccifer2.wordpress.com/ pic.twitter.com/0Wogj3TXuS
16) Tangentially related: "VantageUploader" is the tool DNC use to share vids. JWT arg leaks author email in base64.pic.twitter.com/05OvNYRjoE
17) Final piece of metadata: Creation date and software used to turn DOC into the Gawker PDF (note: could be journo)pic.twitter.com/y9PoKJqTZ0
19) @_fl01 points out "Grizli777" indicates that pirated Office (2007) was used by the hacker.https://twitter.com/_fl01/status/743226251373060097 …
20) Extra data-point: Author on The Smoking Gun's PDF is different again. (good chance this is TSG's journo)pic.twitter.com/3e0fEkv0zF
21) Missed this yesterday, but the hacker contacted TSG (and probably Gawker) via a GMZ.us (anoymous) email addrpic.twitter.com/sIGcxw4DfG
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.