DNC Hack: Arlington Firm Claims Russian Government is Behind Leak

An Arlington-based firm claims the hacker that released hugely damaging emails within the Democratic National Committee has direct ties to Vladimir Putin's Russian government.

Guccifer 2.0 has claimed to be Romanian, but Arlington-based ThreatConnect traced the hacker back to an internet server in Russia, according to a statement from the company.

It's a big claim that suggests Putin is trying to influence the U.S. election and get Donald Trump in the White House over Hillary Clinton, which many people immediately suspected when the emails were released. The emails create a picture of a DNC that plotted against Bernie Sanders in a bid to anoint Clinton as the nominee, and their release forced the resignation of DNC Chair Debbie Wasserman Schultz days ago.

ThreatConnect doesn't believe Guccifer 2.0 is a single person at all, but rather a collection of people within the Russian government attempting to cover for the hacker.

The Arlington firm is the first group of experts to link the hacker to the Russians as the FBI investigates the damaging leak, which threw the Democratic Party into turmoil just as its convention was about to start.

ThreatConnect thinks Guccifer 2.0 is made up of bureaucrats and not sophisticated hackers due to inconsistent remarks on how DNC networks were compromised.

"We conclude Guccifer 2.0 is an apparition created under a hasty Russian D&D campaign, which has clearly evolved into an Active Measures Campaign," ThreatConnect said in the statement. "Those who are operating under the Guccifer 2.0 Twitter, WordPress and Email communications are likely made up [of] a cadre of non-technical politruk attempting to establish 'Guccifer 2.0' as a static fixture on the world stage along the likes of Manning, Assange or Snowden. Their use of Russian VPN services with French infrastructure may shed light on a method Russian intelligence operatives use — domestic services coupled with foreign infrastructure — to help hide their hand and deter any potential attribution to Russia."

You can read the full report here.

ThreatConnect is located at 3865 Wilson Boulevard in Ballston.

Image via ThreatConnect