A purported cyberhack of the daughter of political consultant Paul Manafort suggests that he was the victim of a blackmail attempt while he was serving as Donald Trump’s presidential campaign chairman last summer.

The undated communications, which are allegedly from the iPhone of Manafort’s daughter, include a text that appears to come from a Ukrainian parliamentarian named Serhiy Leshchenko, seeking to reach her father, in which he claims to have politically damaging information about both Manafort and Trump.


Attached to the text is a note to Paul Manafort referring to “bulletproof” evidence related to Manafort’s financial arrangement with Ukraine’s former president, the pro-Russian strongman Viktor Yanukovych, as well as an alleged 2012 meeting between Trump and a close Yanukovych associate named Serhiy Tulub.

“Considering all the facts and evidence that are in my possession, and before possible decision whether to pass this to [the National Anti-Corruption Bureau of Ukraine] or FBI I would like to get your opinion on this and maybe your way to work things out that will persuade me to do otherwise,” reads the note. It is signed “Sergii” — an alternative transliteration of Leshchenko’s given name — and it urges Manafort to respond to an email address that reporters have used to reach Leshchenko.

In the typo-ridden text to Manafort’s daughter to which the note was attached, the sender writes from a different address, “I need to get in touch with Paul i need to share some important information with him regarding ukraine investigation.” The sender adds “as soon as he comes back to me i will pass you documents,” but also warns: “if I don’t get any reply from you iam gonaa pass it on to the fbi and ukrainian authorities including media.”

Leshchenko disavowed the texts in question, telling POLITICO on Tuesday “I've never written any emails or messages to … Manafort or his family. I don't know their contact details.” He added he said “I have nothing to do with” the email address from which the texts were sent.

And in a Facebook post, he wrote that the “correspondence with Manafort's daughter is obviously fake.”

The White House did not respond to a question about whether Trump had met with Tulub, a hunting buddy of Yanukovych’s who had served in the government when Yanukovych was prime minister. But a White House official questioned the chronology supporting the claim, explaining that Trump had not worked with Manafort before the 2016 campaign.

In a Tuesday interview, Manafort denied brokering a 2012 meeting between Trump and Tulub and also pointied out that he wasn’t working for Trump at the time.

However, Manafort did confirm the authenticity of the texts hacked from his daughter’s phone. And he added that, before the texts were sent to his daughter, he had received similar texts to his own phone number from the same address appearing to be affiliated with Leshchenko.

He said he did not respond directly to any of the texts, and instead passed them along to his lawyer. He declined to provide the texts to POLITICO.

The hacked correspondence from his daughter’s phone, much of which is unrelated to Paul Manafort’s work, appears to have first surfaced a couple of weeks ago in an anonymous post on a so-called darknet website run by a hacktivist collective.

While the post hints in its introductory text that the hacker or hackers have additional information on Manafort, it includes only a handful of screenshots of texts from Manafort’s daughter’s cellphone, as well as some data files that appear to be related to the texts.

The images began circulating this week in political circles in Kiev and Washington.

The post comes at a time when there’s intense interest in the connections between Trump’s inner circle and pro-Russian interests. The Federal Bureau of Investigation and congressional committees alike are looking into contacts between Trump’s associates — including Manafort — and Russian officials during the presidential campaign, and the U.S. intelligence community has concluded that Russian intelligence engineered cyberattacks on Democratic officials and groups with the intent of boosting Trump’s presidential campaign by damaging that of his Democratic rival Hillary Clinton.

The screenshots of hacked texts sent to Manafort’s daughter do not include any information indicating the date on which they were sent.

But Manafort said that the first of the texts arrived shortly before The New York Times published an August exposé revealing that the National Anti-Corruption Bureau of Ukraine had obtained documents — which have since come under scrutiny — that appeared to show $12.7 million in cash payments earmarked for Manafort.

Manafort challenged the authenticity of the documents. And, while he said he could not be sure whether the texts apparently referencing them were in fact sent by Leshchenko, he said “I find it coincidental that I got these texts, and then he released these phony journals.”

The Times story identified Leshchenko, a former investigative journalist who has built a reputation as an anti-corruption crusader, as a key player in revealing the documents. They appear to be from a ledger maintained by the Party of Regions, which Yanukovych headed. With financing from pro-Russian oligarchs, Manafort and his team helped resurrect Yanukovych’s career and get him elected prime minister in 2007 and president in 2010. But Yanukovych fled Ukraine for Russia under the protection of Russian President Vladimir Putin amid widespread 2013 protests over government corruption.

The documents eventually were provided to the National Anti-Corruption Bureau, a government agency that had signed an evidence-sharing agreement with the FBI in late June — less than a month and a half before it released the ledgers.

The Times reported that the payments earmarked for Manafort were “a focus” of an investigation by Ukrainian anti-corruption officials, while CNN reported days later that the FBI was pursuing an overlapping inquiry.

Leshchenko held a news conference after the stories to highlight the documents, urging Ukrainian and American law enforcement to aggressively investigate Manafort.

“I believe and understand the basis of these payments are totally against the law — we have the proof from these books,” Leshchenko said during the news conference, which attracted international media coverage. “If Mr. Manafort denies any allegations, I think he has to be interrogated into this case and prove his position that he was not involved in any misconduct on the territory of Ukraine,” Leshchenko added.

Manafort denied receiving any off-the-books cash from Yanukovych’s party and said he had never been contacted about the ledger by Ukrainian or American investigators. Nonetheless, the swirling controversy from the ledger reports forced him to step down from Trump’s campaign.

Yet, after Trump’s surprising victory over Clinton, Ukrainian officials appeared to back away from claims about the ledger and their investigations thereof.

The National Anti-Corruption Bureau of Ukraine told POLITICO in December that a “general investigation" of the ledger was "still ongoing,” but it said Manafort was not a target of the investigation. “As he is not the Ukrainian citizen, [the anti-corruption bureau] by the law couldn’t investigate him personally,” the bureau said in a statement.

Although the bureau is structured as an independent agency, some critics of Ukrainian President Petro Poroshenko contend that the ledgers may have been doctored or even forged and were disseminated with Poroshenko’s tacit support in an effort to damage Trump.

During the campaign, Ukrainian government officials publicly questioned Trump’s fitness for office, and they helped Clinton’s allies research damaging information on Trump and his advisers, according to a POLITICO investigation published last month.

Poroshenko and his allies, who are scrambling to establish a relationship with the Trump administration, have distanced themselves from those efforts, and from Leshchenko.

The anti-corruption bureau is “fully independent,” a Poroshenko spokesman told POLITICO last month. The spokesman said the presidential administration did not take any “targeted action against Manafort.”

The spokesman in a written statement said Leshchenko “positions himself as a representative of internal opposition in the Bloc of Petro Poroshenko’s faction, despite [the fact that] he belongs to the faction,” adding, “it was about him personally who pushed [the anti-corruption bureau] to proceed with investigation on Manafort.”

The post that appears to be the first to disseminate the texts from Manafort’s daughter included some anti-Trump language, justifying the hack as retribution on behalf of those damaged by Trump’s politics.

The site hosting the post is associated with a hacktivist collective that is relatively unknown in the cybersecurity world.

One former U.S. military intelligence cybersecurity analyst said, "I don’t think we’ve got a history with them. They are not a known entity.”

The cybersecurity analyst, whose company patrols cyberspace in search of hacker groups for private clients and government agencies, said the collective “seems like randos, not the nation-states we usually track.”