Jester - FalconGhost

As previously mentioned we of the Falcon Ghost group, we are targeting Energy, Space Aerospace, Military Intelligence (the Intelligence Community as a whole), economic sectors such as Stock Exchanges, Banks and the World Society of Interbank Financial Telecommunications (SWIFT).

In recent months, Falcon Ghost has attacked Israel - the National Cyber ​​Security Authority (Israeli Government-Israel), Intelligence of Israel. France - Emmanuel Macron (President of France) and Germany - BND (Federal Intelligence Service of Germany).

* The information that was stolen from the above targets is in our VPS.
Also as Documents/Reports (describing the whole attack, such as encountered crashes, exploits used in the attack, etc.)

- I recommend taking a look at the VPS Spreadsheets, where you can find ALL machine information, hacked servers, as well as the names of the professionals who took care of Target Security(Team T.I - Information Technology)
Where also as request, were spies. You will find in the spreadsheet details such as:
=============================================================================================================================
*Home address
*IP addresses (personal computers and other devices;)
*Personal information
*Cell phones clipped
=============================================================================================================================
(Use our Framework (CENSORED) *
to have a range of scanning options, such as seeing the device's camera without the individual noticing, capturing all the conversations, calls in the last 24 hours, after the 24 hours have passed, the information collected is destroyed and it collects new information so the process repeats itself.)
As in our last conversation, we will hold a meeting together with the other members of Falcon Ghost.

We are thinking of partnering with other APT groups (which will be our choice), if only if this possibility is confirmed.

* If we partner with a group that has the possibility and care of invading the NSA, the invasion and information gathering will be performed.

Grounds for the invasion:
* Sale of confidential documents
* Stealing NSA exploitations and void (restricted) exploits will have a negative effect on the US political and economic sectors.
* Increase confidence of other markets, Foreign governments in CyberWar (example China)

Problems encountered in SWIFT.

While doing Pivoting and recognition of the EastNets Network (SWIFT). We found an unusual action. There was someone with access on | ENSBDSSL1 External in block IP 192.168.215.20/27 Outside VLAN 5 | where there was a Rootkit (very noisy), collecting all the Documents of Root possession (Administrative) of the VPN.
So we took our remote access for analysis, we started investigating the whole block. Where we did the whole Forensic and investigative process to get the source of the problem.

After the discovery of the Rootkit process, forensic analysis was done, such as reverse engineering of Malware.

* By analyzing the Rootkit source code, the malicious DNS was found to receive the information collected by the malicious software. *

The group responsible for the disorder where almost committed our Data collection operation, arriving at our own investigations was the group APT Carbanak/Fin7.

We were able to configure IPTABLES (Firewall) within the EastNets VPN that blocked the malicious DNS Server from Carbanak.

We upgraded the machines from EastNets so that the exploits that the group in question (Carbanak) were unable to exploit and disrupt the Operation of Falcon Ghost.

As the problem caused, I as founder and responsible for the Falcon Ghost group, I am declaring our disharmony towards the rival APT group.

I request your authorization so that we can plan a possible investigation and that we can compromise the operations of the Carbanak group.

Final information:
- We found vulnerabilities in several banks in Brazil, also found critical flaws in the judicial, executive and legislative sector.
- Negative fact: As the faults are highly gravel, it can have several invaders in the networks of the Brazilian Government.
- We found Google's Zero Day vulnerabilities, we can gather bulk information and exploit the internal network.
- We collect the exploits that the BND(Federal Intelligence Service of Germany) uses for military operations, espionage and other actions in CyberWar.

Please contact the group The Shadow Brokers (TSB), this is the group that we hope to make a friendly partnership.
The meeting will decide this as per the Falcon Ghost members' decision.

I look forward to our next conversation.

Cheers

@Jester, FalconGhost