>but I personally don't find affidavits on "The Smoking Gun" convincing

Are you saying you think the affidavit is fake? Or that the info in the affidavit is not a strong indicator of Russia's involvement?

> but it only shows that someone used (outdated!) malware that is available to any script kiddie, not state-level superhackerware. Stuxnet it ain't.

Russia sometimes intentionally uses unsophisticated malware because it helps to make attribution harder.[1]

> Destabilizing governments and throwing FUD is what the CIA does.

Yes, but it's not what CrowdStrike, ThreatConnect, Secureworks, Fidelis, or FireEye do. Their business is to perform computer security investigations. Why would they jeopardize their business by publishing lies?

> Perhaps [the CIA] are partisan Democrats, distracting from the content of the emails. Perhaps they are never-Trump Republicans.

(a) Just because you're a partisan Democrat doesn't mean you do your job entirely wrong and fill your reports with lies. Same for never-Trump Republicans.

(b) The CIA is not a homogeneous unit. There are people there of various political backgrounds.

(c) Senator Richard Burr, who endorsed Trump[2], who was chosen by Trump to be a national security advisor[3], and who was accused of being "too close to Trump to lead an impartial investigation"[4], led a Senate committee that unanimously said the report was correct:

> A three-year review by the Republican-led Senate Intelligence Committee unanimously found that the intelligence community assessment, pinning blame on Russia and outlining its goals to undercut American democracy, was fundamentally sound and untainted by politics.

> “The I.C.A. reflects strong tradecraft, sound analytical reasoning and proper justification of disagreement in the one analytical line where it occurred,” said Senator Richard M. Burr, Republican of North Carolina and the panel’s chairman. “The committee found no reason to dispute the intelligence community’s conclusions.”[5]

Also, the CIA wasn't the only federal organization involved, the FBI was as well. That would make it harder for the CIA to introduce any lies into the investigation. And the DHS and ODNI agree with the conclusion.[6]

So you want a list of specific hard pieces of evidence. Here are some:

(a) The attackers registered a domain (misdepatrment.com) and pointed it to a known APT-28 command and control IP: 45.32.129.185.[7]

(b) The domain shared an https certificate with a previous attack by Russian APT-28, on Germany.[7]

(c) The malware contained a hardcoded IP (176.31.112.10) that was previously hardcoded in malware used in that attack on Germany.[7][8][9]

(d) A Guccifer 2.0 document contained metadata with the name of a famous Russian person.[7]

(e) A Guccifer 2.0 document contained a message indicating it was edited by a computer with Russian language settings.[7][10][11]

(f) The way Guccifer 2.0 spoke to reporters indicated he was a team of people, because his English skills changed.[7][12]

(g) APT-28 beginning in 2015 launched phishing attacks using a bit.ly account to target 1,800 Google accounts. In 2016, they used that exact same bit.ly account to target Hillary Clinton's campaign.[13][14]

(h) APT-28 previously had created false hacker personas, similar to Guccifer 2.0.[15]

(i) The SeaDaddy malware from the DNC had nearly identical code obfuscation techniques and methods to SeaDuke malware previously attributed to APT-29.[8][16][17]

(j) Guccifer 2.0 used a Russian VPN with a custom config. Possibly an indication that it's a custom government-only deployment of the VPN.[18][19]

(k) Guccifer 2.0 once didn't use the VPN, and the IP was from Moscow.[19]

[1] https://youtu.be/xoNSbm1aX_w?t=286

[2] https://ballotpedia.org/Richard_Burr

[3] https://www.mcclatchydc.com/news/politics-government/electio...

[4] https://www.politico.com/story/2017/02/richard-burr-donald-t...

[5] https://www.nytimes.com/2020/04/21/us/politics/russian-inter...

[6] https://www.dhs.gov/news/2016/10/07/joint-statement-departme...

[7] https://www.vice.com/en/article/4xa5g9/all-signs-point-to-ru...

[8] https://fidelissecurity.com/threatgeek/archive/findings-anal...

[9] https://www.esquire.com/news-politics/a49902/the-russian-emi...

[10] https://arstechnica.com/information-technology/2016/06/gucci...

[11] https://web.archive.org/web/20170919113908if_/https://twitte...

[12] https://www.washingtonpost.com/news/politics/wp/2017/07/06/h...

[13] https://www.secureworks.com/research/threat-group-4127-targe...

[14] https://www.nytimes.com/interactive/2017/01/06/us/russian-ha...

[15] https://threatconnect.com/blog/guccifer-2-0-dnc-breach/

[16] https://unit42.paloaltonetworks.com/unit-42-technical-analys...

[17] https://attack.mitre.org/software/S0053/

[18] https://threatconnect.com/blog/guccifer-2-all-roads-lead-rus...

[19] https://www.thedailybeast.com/exclusive-lone-dnc-hacker-gucc...