I have seen plenty of sextorsion emails over the past couple of years .... but never a VOTEtorsion email. I guess this is one very unique use of a pilfered voter registration database. h/t @MajikaZulJin #Election2020
https://twitter.com/BJS_quire/status/1318567101368500226
Here is an example of a typical sextorsion spam email. None of it is true of course & the same with the VOTEtorsion spam email above. They can not know who you vote for since all voting is anonymous so you can ignore these. #infosec #phishing #infoOps #osint
Actually please contact us if you receive any VOTEtorsion email threatening you to vote a certain way or change party affliation. And try to save the original email for us if possible. Here is more good information from @Donie at @CNN #election2020 https://twitter.com/donie/status/1318726380646027264
So in the VOTEtorsion email we highlight above it says it was sent via saudi-re[.]com but is trying to spoof a Proud Boys email address. We don't have the original so I cant say for sure this is real. But if true, it would imply it was sent from a hacked website in Saudi Arabia
Moreover its a domain that this Saudi Arabian company has been using as a forwarding domain for yrs. The other know VOTEtorsion example so far comes from another likely hacked company in Estonia. This is some pretty serious obfuscation around the identity of the group behind this
So according to @RiskIQ data both the saudi-re[.]com & koolibri[.]ee domains, 2 purported domains used to send the VOTEtorsion emails, had DNS related changes to them within the past 24 hrs. Both are likely hacked websites & one suggests a compromised Sysadmin from Kuwait
So I just realized theres another even more insidious aspect 2 this VOTEtorsion email & that revolves around the phrase underlined in red. This serves to cast doubt & de-legitimize the election. For one thing, it is impossible to have access to the "entire" voting infrastructure
You can follow @SlickRockWeb.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: