Story image

Are Russian hackers targeting Hillary Clinton?

07 Jul 2016

New research has revealed Russian hackers have been targeting key staff members working for Hillary Clinton’s presidential campaign.

The research comes from SecureWorks’ Counter Threat Unit research team, who believes the hackers are working on behalf of the Russian government.

The CTU is calling this Russian hacker group, Threat Group (TG-4127) 

According to the research, utilising spearphishing emails containing Bitly links, used to shorten malicious URLs, TG-4127 attempted to redirect campaign employees to a controlled URL that spoofed a legitimate Google login page. If the target then entered their Google credentials, TG-4127 can then use those entered credentials to access the victim’s corresponding campaign Gmail account. 

By exploiting the Hillary for America campaign mail solution, which uses Gmail, and http://www.hillaryclinton.comwebsite, TG-4127 targeted campaign employees' to access their email account. 

Further observations from CTU researchers found:

·         The first short links targeting hillaryclinton.com email addresses begun being created in mid-March 2016; the last link was created in mid-May

·         TG-4127 created 213 short links targeting 108 email addresses of staff members on the hillaryclinton.com domain. Bitly Data reveals:

o   20 of the 213 short links have been clicked

o   11 links were clicked once

o   8 were clicked twice or more

·         CTU researchers identified the owners of 66 of the targeted hillaryclinton.com email addresses. The identified target email owners held the following titles:

o   National political director

o   Finance director

o   Directors of strategic communications, scheduling, and travel

o   Traveling press secretary

·         There was no open-source footprint for the remaining 42 addresses, suggesting that TG-4127 acquired them from another source, possibly other intelligence activity

“It is well known that users rarely check for the full URL associated with short links; this allows hackers to utilise URL-shortening services to effectively hide malicious URLs,” says  

Alex Tilley, senior security researcher, SecureWorks Counter Threat Unit.

“Businesses need to ensure they are taking the appropriate precautions to minimise the risk of these types of attacks,” he adds.

“It is important to educate users about the risks of spearphishing emails and how to exercise due diligence when faced with a shortened link, especially in unsolicited email messages,” Tilley says.

“Businesses using Gmail as a corporate mail solution, should educate users about the risk of spoofed login pages and encourage them to confirm they are on the legitimate Google Accounts page when presented with a Google login prompt,” he explains.

According to the CTU, TG-4127 has also been observed to target individuals in Russia and the former Soviet states, current and former military and government personnel in the U.S. and Europe, individuals working in the defence and government supply chain, and authors and journalists.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.