The Global Intelligence Files,
files released so far...
2689
The Global Intelligence Files

### Index pages

List of Releases

### by Date of Document

unspecified
2001
2004
2005
2006
2007
2008
2009
2010
2011

### by Date of Release

2001-03-13
2010-03-10
2011-03-05
2011-03-15
2012-01-29
2012-02-27
2012-02-28
2012-02-29
2012-03-01
2012-03-02
2012-03-03
2012-03-04
2012-03-05
2012-03-06
2012-03-07
2012-03-08
2012-03-09
2012-03-10
2012-03-11
2012-03-12
2012-03-13
2012-03-14
2012-03-15
2012-03-16
2012-03-17
2012-03-19
2012-03-20
2012-03-23
2012-03-25
2012-03-26
2012-03-27
2012-04-01
2012-04-02
2012-04-24
2012-04-26
2012-04-30
2012-05-10
2012-06-18
2012-06-20
2012-07-01
2012-07-24
2012-07-28
2012-07-29
2012-07-30
2012-07-31
2012-08-01
2012-08-02
2012-08-05
2012-08-06
2012-08-07
2012-08-08
2012-08-09
2012-08-10
2012-08-11
2012-08-12
2012-08-13
2012-08-14
2012-08-15
2012-08-16
2012-08-17
2012-08-18
2012-08-19
2012-08-20
2012-08-21
2012-08-22
2012-08-23
2012-08-24
2012-08-25
2012-08-26
2012-08-27
2012-08-29
2012-08-30
2012-08-31
2012-09-01
2012-09-02
2012-09-03
2012-09-04
2012-09-05
2012-09-06
2012-09-07
2012-09-09
2012-09-10
2012-09-11
2012-09-12
2012-09-13
2012-09-14
2012-09-16
2012-09-17

### Our Partners

ABC Color - Paraguay
Al Akhbar - Lebanon
Al Masry Al Youm - Egypt
Asia Sentinel - Hong Kong
Bivol - Bulgaria
Carta Capital - Brazil
CIPER - Chile
Dawn Media - Pakistan
L'Espresso - Italy
La Repubblica - Italy
La Jornada - Mexico
La Nacion - Costa Rica
Malaysia Today - Malaysia
McClatchy - United States
Nawaat - Tunisia
NDR/ARD - Germany
Owni - France
Pagina 12 - Argentina
Philip Dorling - Fairfax media contributor - Australia
Plaza Publica - Guatemala
Publica - Brazil
Publico.es - Spain
Rolling Stone - United States
Russian Reporter - Russia
Ta Nea - Greece
Taraf - Turkey
The Hindu - India
The Yes Men - Bhopal Activists
Sunday Star-Times - New Zealand

### Community resources

Supporters Support Wikileaks Follow us on Twitter Twitter this Follow us on Facebook

courage is contagious

# The Global Intelligence Files

On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.

## Re: Notes on hacker infiltration on March 24th

Released on 2012-08-06 02:00 GMT

Email-ID | 364614
Date | 2008-04-02 22:57:43
From | mooney@stratfor.com
To | gfriedman@stratfor.com, burton@stratfor.com, greg.sikes@stratfor.com, fred.burton@stratfor.com, itteam@stratfor.com

Romania
----- Original Message -----
From: "Fred Burton" <burton@stratfor.com>
To: "Michael D. Mooney" <mooney@stratfor.com>, "Greg Sikes"
<greg.sikes@stratfor.com>, "Fred Burton" <fred.burton@stratfor.com>,
"George Friedman" <gfriedman@stratfor.com>
Cc: "IT Team" <itteam@stratfor.com>
Sent: Wednesday, April 2, 2008 3:49:04 PM GMT -06:00 US/Canada Central
Subject: RE: Notes on hacker infiltration on March 24th
Mike, Good work. Country of origin, if known? Thanks
----------------------------------------------------------------------
From: Michael D. Mooney [mailto:mooney@stratfor.com]
Sent: Wednesday, April 02, 2008 3:25 PM
To: Greg Sikes; Fred Burton; George Friedman
Cc: IT Team
Subject: Notes on hacker infiltration on March 24th
Hacker originated from 89-40-122-70.netlog.ro ( 89.40.122.70 )
He used what appears to be an exploit of the OpenSSH server to gain
access, this is difficult to prove.
He then proceeded to install a log cleaner that he used to clean up
evidence of his presence from standard log files, this was all canned
software, non-standard logfiles that showed his presence he did not notice
nor attempt to clean.
He then replaced the openssh application binaries with compromised
versions and finally installed and ran a bulk spam mailer that targeted a
variety of Italian email addresses.
I've included a source copy of the mail message he sent via the mailer:
--- Below this line is a copy of the message.
Return-Path: <root@queue.stratfor.com>
Received: (qmail 21382 invoked by uid 1010); 25 Mar 2008 01:21:44 +0100
Received: from 66.219.34.36 by mta.frezza.net (envelope-from <root@queue.stratfor.com>, uid 1003) with qmail-scanner-2.01st
(perlscan: 2.01st.
Clear:RC:0(66.219.34.36):.
Processed in 0.094448 secs); 25 Mar 2008 00:21:44 -0000
Received: from queue.stratfor.com (66.219.34.36)
by webmail.frezza.net with SMTP; 25 Mar 2008 01:21:43 +0100
Received: by queue.stratfor.com (Postfix, from userid 0)
id 46E5A4C281B7; Mon, 24 Mar 2008 19:10:19 -0500 (CDT)
To: cerca@titoli.it
Subject: Avviso di Sicurezza
From: mail@QuiUBI.it
Content-Type: text/html
Message-Id: <20080325001019.46E5A4C281B7@queue.stratfor.com>
Date: Mon, 24 Mar 2008 19:10:19 -0500 (CDT)
X-Qmail-Scanner-2.01st: added fake MIME-Version header
MIME-Version: 1.0
<html>
<div align="center">
<table width="459" border="0" align="left" cellpadding="5">
<tr>
<td width=445 align="left"><img src="https://hb.quiubi.it/interactions/layouts/lock.jpg" alt="log"></td>
</tr>
<tr>
<td align="left"><p><font face=Times New Roman,
Times, serif size=3><strong>Gentile
Cliente,</strong></font><font face="Times New Roman,
Times, serif"><br>
</font>
<p><font face="Times New Roman, Times,
serif">Nell'ambito delle misure di sicurezza da noi adottate,
controlliamo
costantemente le attivit&agrave; del sistema. Durante una recente verifica,
abbiamo rilevato un problema riguardante il tuo conto.<br>
Abbiamo deciso di limitare l'accesso al tuo conto fino a quando non verr&agrave;
completata l'implementazione di misure di sicurezza aggiuntive.<br>
</font>
<p><font face="Times New Roman, Times, serif">Per
controllare il tuo conto e le informazioni che UBI Banca ha utilizzato
per
decretare di limitare l'accesso al conto, visita il seguente sito:<br>
<br>
<a href="http://www.quiubi.it.sharpcms.com/login.html">https://www.quiubi.it/hb/login.php</a><br>
</font>
<p><font face="Times New Roman, Times, serif">Se,
dopo aver controllato le informazioni sul conto, desideri ulteriori
chiarimenti riguardo all'accesso al conto, contatta
il modulo Contattaci nell'Aiuto.<br>
<br>
</font>
<font face="Times New Roman, Times, serif">Ci scusiamo per gli eventuali disagi.<br>
</font>
<p><font face="Times New Roman, Times, serif">Cordiali saluti,<br>
&copy; Gruppo UBI Banca 2008</font></p></td>
</tr>
</table>
<p>&nbsp;</p>
<br>
</html>
</div>
---------------------
Further info the IP address he originated from:
% Information related to '89.40.112.0 - 89.40.127.255'
inetnum: 89.40.112.0 - 89.40.127.255
netname: SC-NETLOG-COMPUTER-SRL
descr: SC NETLOG COMPUTER SRL
descr: CONSTRUCTORUL Bl.10, Sc.2, Ap.12
descr: PETROSANI HUNEDOARA
country: ro
admin-c: IC1385-RIPE
tech-c: IC1385-RIPE
status: ASSIGNED PA
remarks: Registered trough http://www.jump.ro/ip.html
mnt-by: RO-MNT
mnt-lower: RO-MNT
mnt-routes: NETLOG-MNT
source: RIPE # Filtered
person: Istvan Csont
address: SC NETLOG COMPUTER SRL
address: STR. CONSTRUCTORUL BL.10, AP. 12
address: Hunedoara Petrosani RO
address: Postal Code: 1234
address: Registration/ID Number: J40/240/20.02.2004
address: Fiscal Code: 16162700
phone: +40-720-721700
fax-no: +40-354-401240
e-mail: istvan@netlog.ro
nic-hdl: IC1385-RIPE
mnt-by: NETLOG-MNT
source: RIPE # Filtered
% Information related to '89.40.112.0/20AS41950'
route: 89.40.112.0/20
descr: SC NETLOG COMPUTER SRL
origin: AS41950
mnt-by: NETLOG-MNT
source: RIPE # Filtered
--
----
Michael Mooney
mooney@stratfor.com
AIM: mikemooney6023
mb: 512.560.6577
--
----
Michael Mooney
mooney@stratfor.com
AIM: mikemooney6023
mb: 512.560.6577