Story image

Are Russian hackers targeting Hillary Clinton?

07 Jul 16

New research has revealed Russian hackers have been targeting key staff members working for Hillary Clinton’s presidential campaign.

The research comes from SecureWorks’ Counter Threat Unit research team, who believes the hackers are working on behalf of the Russian government.

The CTU is calling this Russian hacker group, Threat Group (TG-4127) 

According to the research, utilising spearphishing emails containing Bitly links, used to shorten malicious URLs, TG-4127 attempted to redirect campaign employees to a controlled URL that spoofed a legitimate Google login page. If the target then entered their Google credentials, TG-4127 can then use those entered credentials to access the victim’s corresponding campaign Gmail account. 

By exploiting the Hillary for America campaign mail solution, which uses Gmail, and http://www.hillaryclinton.comwebsite, TG-4127 targeted campaign employees' to access their email account. 

Further observations from CTU researchers found:

·         The first short links targeting hillaryclinton.com email addresses begun being created in mid-March 2016; the last link was created in mid-May

·         TG-4127 created 213 short links targeting 108 email addresses of staff members on the hillaryclinton.com domain. Bitly Data reveals:

o   20 of the 213 short links have been clicked

o   11 links were clicked once

o   8 were clicked twice or more

·         CTU researchers identified the owners of 66 of the targeted hillaryclinton.com email addresses. The identified target email owners held the following titles:

o   National political director

o   Finance director

o   Directors of strategic communications, scheduling, and travel

o   Traveling press secretary

·         There was no open-source footprint for the remaining 42 addresses, suggesting that TG-4127 acquired them from another source, possibly other intelligence activity

“It is well known that users rarely check for the full URL associated with short links; this allows hackers to utilise URL-shortening services to effectively hide malicious URLs,” says  

Alex Tilley, senior security researcher, SecureWorks Counter Threat Unit.

“Businesses need to ensure they are taking the appropriate precautions to minimise the risk of these types of attacks,” he adds.

“It is important to educate users about the risks of spearphishing emails and how to exercise due diligence when faced with a shortened link, especially in unsolicited email messages,” Tilley says.

“Businesses using Gmail as a corporate mail solution, should educate users about the risk of spoofed login pages and encourage them to confirm they are on the legitimate Google Accounts page when presented with a Google login prompt,” he explains.

According to the CTU, TG-4127 has also been observed to target individuals in Russia and the former Soviet states, current and former military and government personnel in the U.S. and Europe, individuals working in the defence and government supply chain, and authors and journalists.

Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
"Is this for real?" The reality of fraud against New Zealanders
Is this for real? More often than not these days it can be hard to tell, and it’s okay to be a bit suspicious, especially when it comes to fraud.
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
Kordia launches Women in Tech scholarship at the University of Waikato
The scholarship is established to acknowledge and support up-and-coming female talent and future technology leaders.