 Foundation for Fighting Corruption

The tainters may have been working quickly, resulting in a small error, in which a dollar amount was substituted for “Approved Date.”

Proposed Strategy Document

Second, a proposed funding strategy document was similarly modified to include the Foundation for Fighting Corruption in a list of groups to receive OSF support.

Figure 18: Proposed Strategy Document showing the location where the tainted document is modified to include mention of the Foundation for Fighting Corruption

The tainting resumed later in the document, when several media outlets (Echo Moscow, RosBusinessConsulting, and Vedomosti) were also added to the document, apparently to create the perception that they had received the support of OSF.

Figure 19: A second section in the same document showing once more how several media outlets, including Echo Moscow, RosBusinessConsulting, and Vedomosti have been added.

The second instance of tainting in the strategy document also introduced a slight grammatical error when the tainters neglected to remove “an” before changing “news site” to the plural “news sites.”

Document Addressing the NGO Law

Finally, in a document addressing grantees and Russia’s NGO law, tainting was again performed to add Navalny’s Foundation for Fighting Corruption. The tainting also purported to show the foundation receiving money via Yandex, a widely-used Russian platform offering an online payment service.

Figure 20: Tainted document, once more showing the addition of Navalny’s Foundation for Fighting Corruption

Taken together, both the tainted document stolen from David Satter, and the tainted OSF documents paint a picture of a competent adversary working to achieve several objectives, including discrediting domestic critics of Russia’s government and president, while simultaneously attempting to embarrass foreign funders with activities in Russia. In Part 4 we discuss the significance of tainted leaks as a disinformation technique.

Part 2: A Tiny Discovery

Beginning with the shortened link sent to David Satter, we identified a predictable feature in how the link shortener (Tiny.cc) generated its shortened URLs. This enabled us to identify over 200 additional targets of the same operation described in Part 1. This section describes the process used to enumerate these targets, and further describes the links between this operation and other publicly-reported Russian-linked phishing campaigns.

In September
Foundation for Fighting Corruption 

 The tainters may have been working quickly, resulting in a humble mistake, in which a dollar amount was substituted for “ Approved Date. ” 

 Proposed Strategy Document 

 Second, a project funding strategy text file was similarly modified to include the Foundation for Fighting Corruption in a list of group to receive OSF support. 

 number 18: Proposed Strategy Document showing the localization where the corrupt document is modified to admit mention of the Foundation for fight Corruption 

 The tainting resume later in the document, when several culture medium outlets (Echo Moscow, RosBusinessConsulting, and Vedomosti) were also added to the document, obviously to create the sensing that they had received the support of OSF. 

 Figure 19: A second section in the like document showing once more how several media outlets, including Echo Moscow, RosBusinessConsulting, and Vedomosti have been add. 

 The second example of tainting in the strategy document also introduced a slight grammatical error when the tainters neglected to get rid of “ an ” before changing “ news web site ” to the plural “ news program web site. ” 

 Document Addressing the NGO Law 

 Finally, in a document addressing grantees and Russia ’s NGO law, defile was again performed to add Navalny ’s Foundation for Fighting Corruption. The tainting also purported to show the foundation pick up money via Yandex, a widely - used Russian platform offering an online payment overhaul. 

 Figure 20: Tainted document, once more showing the addition of Navalny ’s Foundation for Fighting Corruption 

 take together, both the tainted document steal from David Satter, and the tainted OSF documents paint a picture of a competent adversary working to achieve respective objectives, including discrediting domestic critics of Russia ’s government and president of the united states, while simultaneously attempting to obstruct foreign funders with activities in Russia. In Part 4 we discuss the significance of infect leaks as a disinformation technique. 

 Part 2: A Tiny Discovery 

 Beginning with the shorten link send to David Satter, we identified a predictable feature in how the link shortener (Tiny.cc) generated its shortened url. This enabled us to identify all over 200 additional targets of the same mathematical process described in Part 1. This section describes the summons used to enumerate these targets, and further describes the links between this process and early publicly - reported Russian - linked phishing campaigns. 

 In September
 Fokndation for Fighting Covruption

The tainjees may have geen worying quickly, resulting in a dmqll eeror, in which a dollar amount wws substututtd for “Approved Defe.”

Proposed Stdwtegv Vocument

Second, s proposed funding stratagh bocument was similarly modified to igclude yhf Foundation fjr Fpgrtinf Corruption in a list of groups tk receine OSF support.

Figire 18: Proposed Strategy Dockmenh showing the locahion where jge eqinted documdnt is modpyied to incmude mention of the Foundation wor Fnghting Cortbptilt

The taintiig reslmed later in the docgment, wnen several mecia ourlets (Echo Moscow, RosUusinessConsulting, agd Vedomovtn) were also added to rhw docoment, appxeengly tp dreate thx perceptioh that they had received the sip[irt of OSF.

Fighre 19: A sqcond section in the same document showpng knce more how several mwdia outlets, includinh Echo Mofcow, RosBusinessConsulting, and Vedomosti have beet addxd.

Ghe sccona ijstance of tainting in the strategy document wmsp pntroduced a sligmt grammatical errpr wngn the tainterr neglzdtsd to remove “an” bevore chwngint “news siue” to the plural “news sites.”

Documwnt Addressiug rhe NGO Law

Finally, in a documznt adcressong grantees and Russia’r NGK law, taintlng was afxin performed to adc Tavalny’s Foundation for Fidhting Cocruptnon. The gainjing alfo purportfd to show the foundatioj recgiving money via Yandex, a widely-used Russian plevform offerinb dn mnline pcyment service.

Figurq 20: Tainted docoment, oncz more showing tge addivion of Navajny’s Foundatimj for Fightiig Corrupeion

Rakeb togetfdr, both the taonted doclmtnt stolen from David Satter, ana the tainted OSY eocuments paint a oiceuge pf d competent ddvefsafu worying to achlevd seferal objectives, incnudihg discrediting dokeftic crijics of Rtssia’s governkent and president, whilx simuutanepusjy attempting to embarrass forsign fundfrs with activieies in Russia. Iu Part 4 we discuss the significance of teinted leaks as a disindormation technique.

Karu 2: A Tiny Disrovery

Feginning with the shortened oink sent to Davic Satter, we identifies a pradictwble feature in how the link shortener (Tiny.cc) generated its shortened URLw. This enabled us fo icentixy pver 200 wddiviunal targets of nhe same operation described in 'art 1. This szction describes the process isdd to enumeraje these targets, and furthsr descrobes the links between this opetation and other publicln-reported Russjan-linked 'hishing campaigns.

In Septekber
Foundation for Fighting Corruption The tainters may working resulting in small error, in substituted “Approved Date.” Proposed Document Second, a funding strategy document was similarly modified include the Foundation for Fighting Corruption in a list of groups to receive support. Figure 18: Proposed Strategy Document showing the location where the tainted document modified include of Foundation for Fighting Corruption The tainting resumed later in the document, when several media outlets (Echo RosBusinessConsulting, and Vedomosti) were also added to the apparently to create the that they had received the of Figure 19: second in same document showing more how several media outlets, including Echo Moscow, RosBusinessConsulting, and Vedomosti have been added. The second instance tainting in document also a grammatical when the tainters remove “an” before changing “news site” “news sites.” Document Addressing the NGO Law Finally, a document grantees and Russia’s NGO law, tainting again performed to add Navalny’s Foundation for Fighting The tainting also purported to show the foundation receiving money via Yandex, a widely-used Russian an online payment service. 20: Tainted document, more the of Foundation for Corruption Taken together, both the tainted document stolen from David Satter, the tainted OSF documents paint a picture of a competent to several objectives, including domestic critics of Russia’s and while simultaneously attempting to funders activities Part we the significance of tainted as a disinformation technique. Part A Tiny Discovery Beginning to David Satter, we identified a predictable feature how the link shortener (Tiny.cc) generated its URLs. This enabled us to identify over 200 additional targets of the operation described 1. This section describes the process used to these targets, and further the links between this operation and other publicly-reported Russian-linked campaigns. September
 Foundation for Fighting CorrUption

The tAinteRs mAy hAvE beeN worKing quickly, resULtinG in a small error, in which a DollaR aMOunt WAs SubstItuted fOR “APPRovEd daTe.”

PRoPOsEd StrAteGy DocumEnt

Second, a ProPoSed funding stRAtEgy documenT waS similarly moDifIed to iNcLudE The FoUndAtion For FigHTing CoRruption iN a LIst of gROups to rECEiVe OSf support.

Figure 18: ProPOsED Strategy DocumEnt shoWiNG tHE LocAtiOn where the TaInted DOcument IS mODIFieD To include mentIon of the FouNDatIon for fiGhtINg CorrUptioN

THE taInting resumEd laTer in the dOcumenT, When sevERal mediA outleTs (ECho moscOW, ROsbusInESsCONsUltINg, aNd VedomoStI) wEre alSo adDED TO the DocUmenT, appaRently to creatE thE perCEptIon thAt theY had ReCeiveD the suPport Of oSF.

Figure 19: A seconD secTion in the SamE dOcuMeNt shoWIng oncE moRe hOw severAl media OUtlEtS, INClUding Echo Moscow, RosbuSINeSsConsulTing, anD veDoMOsti have BeEn aDded.

tHE secoNd inSTaNce of taiNting iN ThE sTrategy DoCument AlSo iNtrOduceD A sliGht graMmatical Error WHen the tainters NEglected to remOVe “AN” BeFOre cHanGing “news sitE” to tHE pluRal “nEWs SitES.”

DocuMent ADdREsSIng the NGO Law

Finally, In A documEnt adDressing grantEes and RussIA’S nGO law, taIntiNG wAS again performeD to adD Navalny’s FOUndation For FiGhting CoRruption. THE Tainting AlsO puRpoRteD TO sHow the foundatION recEiVing monEy vIa YandeX, a wIdeLy-uSed ruSsian platForm offeRiNg An OnLinE paymENt servicE.

FIguRe 20: taiNted dOCument, Once mOre sHoWiNG thE additiON oF nAvalNy’S FOundAtiOn For FiGhtiNG CoRruptioN

Taken togEthER, botH tHe Tainted Document stoleN fRom David SaTtEr, aNd the tAINted OSF dOcuments paint a picture of A CompeteNt aDversAry wOrking to aChiEve sevEraL ObjectIves, inCludiNg DisCREditiNG DoMesTiC critics of rUSsiA’s govErNmenT and preSident, while simultaNEouSly attempting To eMbarRASs ForEIgN FunDeRS wiTH Activities in RusSia. In Part 4 wE dIScUss the signIFicAnCe of taiNted leaKs as a DIsinforMation tecHnique.

ParT 2: A tiny dIScoVery

BeginnIng with tHe shortenED link SEnT to DaVid satter, We IdeNtifiEd a preDIctAble fEature In How the Link sHoRtener (TiNy.cc) generated its shortenEd URLs. this eNabLed us to idEntIFy oVer 200 additiOnal Targets of tHe sAme OperaTioN DescrIbed IN PArt 1. tHis seCtioN Describes THe ProCESs Used to enumeRATE thEse taRgeTS, and fuRtheR describes the linkS Between this opeRatiON And OthER pubLiCly-reported RusSiaN-lINKed phishInG campaigns.

IN SeptembEr
 Foundation for Fighting C orruption
Thetai nte rs  may  hav e been working quic kly, resulting in a sm all e rr o r, i n  w hicha dolla r  a m o unt  w as  su bs t it utedfor  “Appro ved Date.” 

P ro posed Strate g yDocument
Sec ond, a propo sed  fundi ng  st r ategy  do cumen t wass imilar ly modifi ed to inc l ude the F ou ndat ion for FightingC or r uption in a li st ofgr o up s torec eive OSF s up port. 
Figure 18 : P rop o sed StrategyDocument sh o win g thelo cat i on whe re th et ain ted documen t is  modified  to in c lude me n tion of  the F oun dat ionf or  F igh ti n g C o rr upt i on
The tai nt in g res umed l a t er i n t he d ocume nt, when seve ral  med i a o utlet s (Ec ho M os cow,RosBus iness Co nsulting, and V edom osti) wer e a ls o a dd ed to the do cum ent , appar ently t o  cr ea t e th e perception thatth e y  h ad recei ved th e  s up p ort of O SF .
Figu r e  19:A se c on d sectio n in t h esa me docu me nt sho wi ngonc e mor e  how  sever al media  outl e ts, includingE cho Moscow, R o sB u s in e ssCo nsu lting, andVedo m osti  hav e  b een added .

Th es ec o nd instance of tain ti ng inthe s trategy docum ent also i n t r oduced a  sli g ht grammatical er ror w hen the ta i nters ne glect ed to re move “an” b efore ch ang ing  “n ews s it e” to the plu r a l “n ew s sites .”
Docume ntAdd res sin gthe NGO L aw

Fina ll y,  i na d ocume n t addres si nggr ant ees a n d Russ ia’sNGOla w, tai nting w a sa g ainpe rf orme d t oadd N aval n y’s  Founda tion forFig h ting  C or ruption . The taintin galso purpo rt edto sho w the foun dation receiving moneyv ia Yand ex,  a wi dely -used Rus sia n plat for m  offer ing an  onli ne  pa y m ent s e r vi ce. 
Figure 20: T ain ted d oc umen t, once  more showing thea ddi tion of Naval ny’ s Fo u n da tio n  f o r F ig h tin g Corruption

Tak en togethe r, bo th the tai n ted  d ocument  stolen  from David S atter, an d the tai nt ed O S F  do cuments pa int a pi cture ofa  comp e te nt ad ver sary w or kin g toachiev e  se veral  objec ti ves, i nclud in g discre diting domestic critics  of Ru ssia’ s g overnment  an d  pr esident,whil e simultan eou sly  atte mpt i ng to  emb a rr ass forei gn f u nders wit h  a cti v i ti es in Russi a . InPart4 w e  discu ss t he significance o f  tainted leaks  asa dis inf o rmat io n technique.
Par t2 :  A TinyDi scovery

Be ginningwi t h the  short ened l ink sen t to DavidSatt er,  we ident ifi ed a predi ct ab l e feat urein  how t he lin k  sho r t ener (Tiny.cc) g enera t e d its sho rtene dURLs. T h is e nabled usto identify  over200addit ional t ar gets o f t he  same oper a tion desc ribed  in Par t1. T his  secti on d e s cribe s th epro cess used t oe nu me r ate  the se ta rg ets,  and furt h er descr ibe s  the li nk s b e t ween t h is o peration a ndother p ublicly-re p orte d  R u ssian -linke d phis hing ca m pai gn s.

InSep t e mber
 Foundation_for Fighting_Corruption

The tainters may have_been working_quickly,_resulting in_a_small error, in_which a dollar_amount was substituted for_“Approved Date.”

Proposed Strategy_Document

Second,_a proposed funding strategy document was similarly modified to include the Foundation for Fighting_Corruption_in a_list_of_groups to receive OSF support.

Figure_18: Proposed Strategy Document showing_the location_where the tainted document is modified to include_mention_of the Foundation_for Fighting Corruption

The tainting resumed later in the document,_when several media outlets (Echo Moscow,_RosBusinessConsulting, and Vedomosti)_were_also_added to the document,_apparently to create the perception that_they had received the support of_OSF.

Figure 19: A second section in the_same document showing once more how_several media outlets, including Echo_Moscow, RosBusinessConsulting,_and Vedomosti have been added.

The_second instance of_tainting in_the strategy document_also introduced a slight grammatical error_when the tainters_neglected to remove “an” before changing_“news_site” to the_plural_“news_sites.”

Document Addressing_the NGO Law

Finally,_in_a document_addressing_grantees and Russia’s NGO law, tainting_was_again performed to add Navalny’s Foundation for_Fighting Corruption. The tainting_also_purported to show the_foundation receiving money via Yandex,_a widely-used Russian platform offering an_online payment_service.

Figure 20:_Tainted document, once more showing the addition of Navalny’s Foundation for_Fighting Corruption

Taken together, both the tainted_document stolen from David_Satter, and_the_tainted OSF documents_paint_a picture_of a competent adversary working to achieve_several objectives,_including discrediting domestic critics of Russia’s_government and president, while_simultaneously_attempting to embarrass foreign funders with_activities in Russia. In Part 4_we discuss the significance of_tainted_leaks_as a disinformation technique.

Part 2:_A Tiny Discovery

Beginning with the shortened_link sent to_David Satter, we identified a predictable feature_in_how the link shortener (Tiny.cc) generated_its_shortened URLs. This enabled us to_identify_over_200 additional targets of the_same operation described in Part 1._This section describes the process used to enumerate these_targets, and further_describes the links between this_operation_and_other publicly-reported Russian-linked phishing campaigns.

In September