Login

ADVERTISEMENT

Hackers said to target Senate

PARIS -- The same Russian government-aligned hackers who penetrated the Democratic Party have spent the past few months laying the groundwork for an espionage campaign against the U.S. Senate, a cybersecurity firm said Friday.

The revelation suggests the group, whose hacking campaign scrambled the 2016 U.S. electoral contest, is still busy trying to gather the emails of America's political elite. The group is often nicknamed Fancy Bear.

"They're still very active -- in making preparations at least -- to influence public opinion again," said Feike Hacquebord, a security researcher at Trend Micro Inc., which published the report. "They are looking for information they might leak later."

The Senate Sergeant at Arms office, which is responsible for the upper house's security, declined to comment.

Hacquebord said he based his report on the discovery of a clutch of suspicious-looking websites dressed up to look like the U.S. Senate's internal email system. He then cross-referenced digital fingerprints associated with those sites to ones used almost exclusively by Fancy Bear, which his Tokyo-based firm dubs Pawn Storm.

Trend Micro previously drew international attention when it used an identical technique to uncover a set of decoy websites apparently set up to harvest emails from the French presidential candidate Emmanuel Macron's campaign in April. The sites' discovery was followed two months later by a still-unexplained publication of private emails from several Macron staff members in the final days of the race.

Hacquebord said the rogue Senate sites -- which were set up in June and September -- matched their French counterparts.

"That is exactly the way they attacked the Macron campaign in France," he said.

Attribution is extremely tricky in the world of cybersecurity, where hackers routinely use misdirection and red herrings to fool their adversaries. But Trend Micro said there could be no doubt.

"We are 100 percent sure that it can be attributed to the Pawn Storm group," said Rik Ferguson, one of Hacquebord's colleagues.

Like many cybersecurity companies, Trend Micro refuses to speculate publicly on who is behind such groups, referring to Pawn Storm only as having "Russia-related interests."

But the U.S. intelligence community alleges that Russia's military intelligence service pulls the hackers' strings, and a monthslong Associated Press investigation into the group, drawing on a vast database of targets supplied by the cybersecurity firm Secureworks, has determined that the group is closely attuned to the Kremlin's objectives.

If Fancy Bear has targeted the Senate over the past few months, it wouldn't be the first time. An AP analysis of Secureworks' list shows that several staff members there were targeted between 2015 and 2016.

Among them: Robert Zarate, now the foreign policy adviser to Sen. Marco Rubio, R-Fla.; Josh Holmes, a former chief of staff to Senate Majority Leader Mitch McConnell who now runs a Washington consultancy; and Jason Thielman, the chief of staff to Sen. Steve Daines, R-Mont. A congressional researcher specializing in national security issues was also targeted.

Fancy Bear's interests aren't limited to U.S. politics; the group also appears to have the Olympics in mind.

Trend Micro's report said the group had set up infrastructure aimed at collecting emails from a series of Olympic winter sports federations, including the International Ski Federation, the International Ice Hockey Federation, the International Bobsleigh & Skeleton Federation, the International Luge Federation and the International Biathlon Union.

The targeting of Olympic groups comes as relations between Russia and the International Olympic Committee are particularly fraught. Russian athletes are being forced to compete under a neutral flag in next month's Pyeongchang Olympics after an extraordinary doping scandal has seen 43 athletes and several Russian officials banned for life.

Information for this article was contributed by James Ellingworth of The Associated Press.

A Section on 01/13/2018

Comments

23cal says...

This obviously cannot be happening because Trump said there was no interference. Obviously, if there had been interference, Dear Leader would have done something to preclude more interference such as is laid out in this article.
*
How sad that his cultists are so deeply in denial that they are willing and eager to throw the foundation of America, the electoral process, under the bus instead of admitting there is a problem and udemanding that it be addressed.
*
They---and their Dear Leader--- are pathetic.

Posted 13 January 2018, 7:21 a.m. Suggest removal

Log in to comment