Guccifer 2.0

From A Closer Look On Syria
Jump to navigation Jump to search
Guccifer 2.0 timeline


  • ‘Guccifer 2.0’ Is Likely a Russian Government Attempt to Cover Up Its Own Hack - Lorenzo Franceschi-Bicchierai, Motherboard, June 16 2016
  • We Spoke to DNC Hacker 'Guccifer 2.0' - Lorenzo Franceschi-Bicchierai, Motherboard, June 21 2016
    Last week, a mysterious hacker using the handle "Guccifer 2.0" emerged to claim responsibility for the data breach at the Democratic National Committee, which democrats and several cybersecurity firms attributed to two groups of Russian hackers, likely working for Vladimir Putin's government.
  • "Did the Russians really hack the DNC or is this another Sony Pictures moment? You decide" - The Register, July 27, 2016 + threatconnect
    We're told Team Guccifer used AOL France's webmail to exchange messages with journalists; these messages, sent from, were stamped with a French IP address – – by AOL's infrastructure, meaning the sender was using that network address at the time
    ...It is important to note that the IP address seen in the Guccifer 2.0 AOL communications – – is not listed as an option within Elite VPN Service, although it has an identical SSH fingerprint and has the exact same port (1723, PPTP) open as the listed options. This demonstrates the server was cloned from the same server image as all the Elite VPN servers but may be a private or dedicated version of the service." ThreatConnect also notes that the IP address has been used in a few swindles, including a Russian mail-order bride scam in 2014 and attacks against WordPress blogs last year. The IP address also crops up in a Russian-language text message proxy service and a node list for crypto-currency EDR
    Russian foreign minister Sergey Lavrov gave a simple reply when asked about the matter by the press. "I don't want to use four-letter words," he said.
  • ‘Lone DNC Hacker’ Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer -The Daily Beast', March 22, 2018
    Claims made; no supporting data provided.
    But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter.
    How do you distinguish 'VPN' from a 'real IP address' in the 'logs of a social media company'? Just how much info is actually recorded?
  • Habakkuk on metadata, David Habbakkuk, July 18, 2018
  • Forensic Data Proves DNC Was Not Hacked by Russia - Forbidden Knowledge TV, July 17, 2018
  • Guccifer 2.0: Evidence Versus GRU Attribution - Adam Carter, December 20, 2019

Was Guccifer 2.0 a cover-up?

Private communications

Robbin Young

Marcy Wheeler

Who is Guccifer 2.0?

Warren Flood?

Michael L. Adams?

Israeli intelligence?


See DNC_Leak#Indictments