Reporters United, amid the eavesdropping scandal, claim that a «spear phishing» operation was set up to deceive, intimidate and possibly defame Reporters United. See below for the detailed article that was posted on the website.
Early November a source with very good knowledge of our interception network warned that some (whom he photographed) «targeting» Reporters United and «preparing something». A short while later, the warning became reality. We reveal a «spear phishing» operation that was set up to deceive, intimidate and possibly defame Reporters United. It includes the creation of a fake website, the invention of a non‑existent international journalist, and access to tax data of Reporters United that only the AADE knows.
The first ten days of November, two journalists from Reporters United met a source with very good knowledge of the eavesdropping scandal. During the discussion, the source gave an oral warning to reporters Leontopoulos and Chondrogianno that individuals connected to a state institution «are looking for you. In the coming days expect something». We will not reveal who the source named.
At this meeting, two more people who are not associated with Reporters United – we note this in case the incident report is disputed. Then, of course, we were not sure how to interpret the information: Was it a warning or an indirect threat? Or was it just idle talk?
See also: Predator Greece: Intellexa and KRIKEL behind the wiretapping?
36 hours later, the warning becomes reality
Not even 36 hours had passed, and at Reporters United we received a strange -as will become clear later- email.
The subject was «Questions concerning financial transparency – Journalists Research» («Questions regarding financial transparency – Journalists Research»). In his message, the mysterious -as we will prove- sender posed 16 questions to Reporters United, among others concerning the financial transparency of the project and the past of its contributors. Without specifying his full name and his status, he mentioned that he had conducted a four-month investigation on the topic and that he would publish his findings after November 18.
See also: Israelis behind interception of mobile phones and WiFi at airports in Greece
Internal access to the Taxis of Reporters United
Some of the questions were reasonable. Others were obviously phrased to create misleading impressions about Reporters United.
However, there was also a third category of questions that gave us greater concern: The sender knew with exhaustive precision (to a decimal place) the tax data of Reporters United that is not public, and therefore access to it could only be secured from within, via the Taxis system and the AADE.
A site that was built especially for Reporters United
From the email sending the questions (dw@dwfreejournal.org) it appears that the organization allegedly conducting the research for Reporters United is called DW Free Journal. We visited the relevant website, however we were impressed that it did not have even a single published study.
Finally, a search in the domain data revealed that «dwfreejournal.org» was created on November 11, 2022, i.e., the same day we received the questions that investigated Reporters United!
The organization conducting research for Reporters United is made so quickly and hastily that it doesn't even have social networks. Indeed, we clicked the website's buttons to see the accounts of DW Free Journal, but we didn't find Facebook, Instagram, Twitter, or YouTube.
See also: Predator intercepts: Intellexa continues its business undisturbed in Greece
Gmail advises caution with this message
Gmail itself flagged the email we received as suspicious and warned that «could not verify whether it originated from dwfreejournal.org». («Gmail could not verify that it actually came from dwfreejournal.org».)
Operation «spear phishing»
It appears to be a «spear phishing»: Unlike the usual phishing, in spear (spear) phishing (electronic fishing) the electronic attack is carried out with the purpose of hitting, deceiving or destabilizing a specific target, organization or person.
There are clear indications that to set up and operate this business, money and man-hours were spent at six different levels: research of the financial and legal data of Reporters United, research into the activities and social network contacts of its members, access to tax data of the AADE that is not publicly accessible, website creation, sending queries and translating them into English, an effort to hide the digital footprints of the entire operation.
Beyond whether it was an attempt at «spam» or «phishing», there were also qualitative characteristics in the message that made it seem strange.
1. There was no sender name, nor title, except for the cryptic dw.
2. The email arrived in our inbox on November 11, just one week before the hearing scheduled for the trial of Grigoris Dimitriadis' lawsuit against Reporters United, the Editors' Newspaper, Thanasis Koukakis and the two reporters who signed the investigation that caused the resignation of the secretary general and nephew of the prime minister. And with a deadline to respond on November 18, that is, the day after the hearing. However, let us note that to date there has been no publication or new communication from the fictional journalist.
3. The message and the questions were written in English, but the language betrayed that the person who wrote it had essentially mistranslated the content from Greek to English.
4. Both the email and the website of the unknown sender refer to Deutsche Welle and its program titled “Journal” with the initials DW. When we Googled “DW Free Journal,” all the results in the search referred to the specific media outlet and the news program. Perhaps the sender wanted to give credibility to his message in this way, without success of course, by associating himself with a reliable medium – a practice reminiscent of the links to fake websites sent by Predator in an attempt to trap phones.
Those days we didn't have time for such things. On one hand we were preparing for the trial (although eventually our lawyers requested a short postponement), on the other hand we were preparing to publish our investigation of the businessman Giannis Lavrano, the central figure in the Predator case, and his connections with top political figures. (Leaks: All identities of Giannis Lavrano, 12.11.2022, Reporters United & ΕφΣυν)
We discussed within the Reporters United team and jointly decided that we would not let the message distract us. We would answer the questions after the publication of the investigation on Lavrano and the end of the trial. On one condition: that the mysterious sender provides us with sufficient information about his identity – and indeed we requested this from “dw» with an email we sent on November 21.
See Reporters United's reports for 2020 and 2021.
The fictional Mr. «Dave Woods»
To get to the bottom of it, we visited the DW Free Journal, i.e., the entity that is supposed to publish the research that concerned us. The English-language website is said to host the work of someone «Dave Woods», who is described as «an experienced multimedia journalist with 18 years of experience in investigative journalism in the USA, the United Kingdom and Israel».
On the second and final page of the website, Dave» states that he has uncovered several major reports» throughout his career (most recently Cambrdige Analytica, Paradise [sic] Panama Papers».
Nothing ap’ all of this is confirmed, of course: We identified some «Dave Woods» journalists, but none of them with the sender's email profile. We addressed a query to him as well, asking him to provide at least a minimal piece of identity before we answer his questions.
So far we have not received any response.
For the story, and because the strength of the Reporters United initiative is its transparency and independence, we will soon present the questions that «Dave Woods» sent us, translated into Greek, and we will answer them one by one.
Source of information: www.reportersunited.gr
