CyberBerkut: The world should know and see it!

We, CyberBerkut, have received a file which value cannot be overestimated in the order!

Expensive senator McCain! We recommend to you next time in foreign trips, and especially for territory of Ukraine, not to take with themselves confidential documents.

On one of devices of your colleagues we have found a lot of the interesting. We have decided to lay out Something: given video should become property of world community!

Download video original

We are CyberBerkut! We will not forget! We will not forgive!



Debunked: CyberBerkut Video Supposedly Showing Staged ISIS beheading of Foley


WARNING: While no actual cutting or gore will be shown in this post, some of the images and animations in this article and the comments may be disturbing.

A low resolution video appeared on the web site of pro-Russian hacking group CyberBerkut, dated July 10th, with the description:

The video shows a very brightly lit stage with simulated desert floor and a greenish backdrop. A film crew and multiple lights surround the stage, but they are strongly backlit. The video has no audio, and is very low resolution so no details can be made out. The kneeling man wears a head cover, to suggest that the head could be replaced by a computer generated image, or separately recorded video.

The video appears to be an attempt to replicate one of the „Jihadi John“ beheading videos of 2014. In particular it appears to be an attempt to replicate the video of James Foley. None of those videos show actual beheadings, and instead show Jihadi John sawing at the neck with no apparent blood, and then they cut to a shot of a decapitated head posed on top of a body. This led to speculation that the videos were faked.

The CyberBerkut video seems to be an attempt to reinforce that idea, and has been picked up as such by several alternative media outlets, like Infowars:

However we can tell it is not a video of the faking of any of the Jihadi John videos for a number of reasons.

The video does not match

The actions in the video most closely resemble the James Foley video. The „Jihadi John“ figure in the Cyberberkut video seems to be trying very carefully to replaced the actions of the original when he steps in to pretend to cut the neck. But putting these videos side by side (synced up with the moment the JJ figure puts his hand on the neck) reveals differences.
The first thing you notice is how similar they are, which indicates a deliberate attempt to duplicate. However there are several differences, apparent even here.

At the start, the real Jihadi John has his arm by his side, but the second Jihadi John has his arm on the back of the prisoner’s neck.

The prisoner has his knees wider, which then forces JJ2 to have a much wider stance.

Notice also the gun. In the original the gun in the holster swings out level with his hand. In the fake it is not visible at all during the same motion.

After that point, the video diverges even more significantly. The JJ figure has his head tilted in the opposite direction, and starts fake cutting far too quickly.

This incorrect head tilt applies to all of the similar videos: Foley, Sotloff, Haines, and Henning – in all four videos Jihadi John’s head is angles to the camera right. This means that the CyberBerkut video matches none of them.

The lighting is all wrong

In the original the scene is lit from the front with the sun high, and to the right of the camera. It’s very clear there’s a single light source, and that it’s the sun. In the fake, the primary lighting on the prisoner comes from the comes frombehind the prisoner, and to the left of the camera

In fact the scene is very strongly lit from behind. You can see multiple shadows cast towards the camera by the actors, and the „director“. So it’s clear the strongest light sources are coming from behind. This does not match the original at all.

The people faking the video do not seem to have considered that the ground is visible in a portion of the original, so you can quite clearly see the direction of the shadows is wrong.

It’s not real green screen

The „studio“ does not really look like a green screen studio either. Compare it to real green screen studios:

Does the Metadata tell us anything?

The link to the „original file“ on CyberBerkut goes to:
(File mirrored here: MD5=
9a37e2f7a6396bf71fb351d7917e58c6 )

Dumping the Time metadata gives us:

mp4file --dump world_need_to_know_this.mp4 | grep Time
  "world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
  "world_need_to_know_this.mp4": modificationTime = 3517850714 (0xd1ae245a)
	"world_need_to_know_this.mp4": creationTime = 0 (0x00000000)
	"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)
	"world_need_to_know_this.mp4": creationTime = 0 (0x00000000)
	"world_need_to_know_this.mp4": modificationTime = 3517850714 (0xd1ae245a)
	"world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
	"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)
	"world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
	"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)

Other than the zero timestamp there are two timestamps, one second apart in Mac timestamp format, which can be converted here:
And they resolve to Mon, 22 Jun 2015 20:45:14 GMT (and one second later).

All this timestamp tells us is the likely date that the file was exported from the video creation software. It’s not 100% as timestamps can be faked, but it would seem more likely that the creators would want to fake an earlier time, so this is likely the correct date and time.

However this does not tell you when the original video was recorded. It only tells you when it was exported from the video editor.


Kommentar verfassen

Trage deine Daten unten ein oder klicke ein Icon um dich einzuloggen:

Du kommentierst mit Deinem Abmelden /  Ändern )

Google+ Foto

Du kommentierst mit Deinem Google+-Konto. Abmelden /  Ändern )


Du kommentierst mit Deinem Twitter-Konto. Abmelden /  Ändern )


Du kommentierst mit Deinem Facebook-Konto. Abmelden /  Ändern )


Verbinde mit %s

%d Bloggern gefällt das: