Additionally, one of these dedicated accounts was used by the Conspirators in or around 2015 to renew the registration of a domain (linuxkrnl.net) encoded in certain X-Agent malware installed on the DNC network.
62. The Conspirators funded the purchase of computer infrastructure for their hacking activity in part by "mining" bitcoin. Individuals and entities can mine bitcoin by allowing their computing power to be used to verify and record payments on the bitcoin public ledger, a service for which they are rewarded with freshly-minted bitcoin. The pool of bitcoin generated from the GRU's mining activity was used, for example, to pay a Romanian company to register the domain dcleaks.com through a payment processing company located in the United States.
63. In addition to mining bitcoin, the Conspirators acquired bitcoin through a variety of means designed to obscure the origin of the funds. This included purchasing bitcoin through peer-to-peer exchanges, moving funds through other digital currencies, and using pre-paid cards. They also enlisted the assistance of one or more third-party exchangers who facilitated layered transactions through digital currency exchange platforms providing heightened anonymity.
64. The Conspirators used the same funding structure-and in some cases, the very same pool of funds-to purchase key accounts, servers, and domains used in their election-related hacking activity.
- a. The bitcoin mining operation that funded the registration payment for dcleaks.com also sent newly-minted bitcoin to a bitcoin address controlled by "Daniel Farell," the persona that was used to renew the domain linuxkrnl.net. The bitcoin mining operation also funded, through the same bitcoin address, the purchase of servers and domains used in the GRU' s spearphishing operations, including accountsqooqle.com and account-gooogle.com.
23
