U.S. Department of Justice
Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e)
To operate X-Agent and X-Tunnel on the DCCC and DNC networks, Unit 26165 officers set up a group of computers outside those networks to communicate with the implanted malware.[1] The first set of GRU-controlled computers, known by the GRU as "middle servers," sent and received messages to and from malware on the DNC/DCCC networks. The middle servers, in turn, relayed messages to a second set of GRU-controlled computers, labeled internally by the GRU as an "AMS Panel." The AMS Panel Investigative Technique served as a nerve center through which GRU officers monitored and directed the malware's operations on the DNC/DCCC networks.[2]
The AMS Panel used to control X-Agent during the DCCC and DNC intrusions was housed on a leased computer located near IT Arizona.[3] Investigative Technique
[4]
Investigative Technique
Investigative Technique
- ↑ In connection with these intrusions, the GRU used computers (virtual private networks, dedicated servers operated by hosting companies, etc.) that it leased from third-party providers located all over the world, The investigation identified rental agreements and payments for computers located in, inter alia, Investigative Technique all of which were used in the operations targeting the U.S. election.
- ↑ Netyksho Indictment ¶ 25
- ↑ Netyksho Indictment ¶ 24({c).
- ↑ Netyksho Indictment ¶ 24(b).
39
