How Cyber Propaganda Influenced Politics in 2016

Throughout history, politically motivated threat actors have been interested in changing the public opinion to reach their goals.In recent years the popularity of the Internet gave these threat actors new tools. Not only do they make use of social media to spin the news, spread rumors and fake news, but they also actively hack into political organisations.

Political organisations are a relatively easy target for threat actors who want to cause harm. By their very nature, political parties must be able to communicate openly with their members, the press and the general public.

A political party is particularly vulnerable to spying campaigns and cyber-attacks during a hectic election period, where security measures might be considered a burden to daily operations. Recent events in 2016 have demonstrated how important security is for political organizations.

In 2016, we saw at least eight different high-profile attack campaigns against political organisations in countries like the United States, Germany, Ukraine, Turkey, and Montenegro. These campaigns were not meant for espionage alone, but for active interference with political processes and to influence public opinion.

WikiLeaks and mainstream media were used to get the general public to learn about alleged scandals that may or may not have happened in the political organizations that were targeted. Stolen data was published, but the authenticity of the data was usually not confirmed. This leaves room for threat actors to alter the stolen data to their own benefit and present it as if it was real and unaltered.

By publishing carefully selected pieces of unaltered stolen data, threat actors can better influence public opinion towards a direction that is favorable to their interests.

In 2016 the Democratic Party in the US was allegedly hacked by Pawn Storm, a threat actor group known for targeting people and organizations that might be perceived as a threat to Russia.

For example, between 2014 and 2016 Pawn Storm set up dedicated campaigns against the armed forces of at least a dozen countries. Pawn Storm’s activities show that foreign and domestic espionage and influence on geopolitics are the group’s main motives, and not financial gain.

It is a fact that e-mails were stolen from members of the Democratic Party. These e-mails were leaked by WikiLeaks and dcleaks[.]com, a website that’s likely controlled by the Pawn Storm actors.

We can confirm that in March and April of 2016, Pawn Storm launched an aggressive credential phishing campaign against corporate and free webmail accounts of various high ranking members of the Democratic Party in the US.

During the campaign, dozens of politicians, Democratic National Committee (DNC) staff, speech writers, data analysts, former staff of the Obama campaign, staff of the Hillary Clinton campaign, and even corporate sponsors were targeted multiple times.

We know this because we have been tracking credential phishing attacks by Pawn Storm since 2014. We were able to obtain a substantial amount of click statistics on tens of thousands of individual phishing URLs, and published an early analysis of this data in 2015.

In June 2016, we discovered a serious compromise of the website of the DCCC (Democratic Congressional Campaign Committee) that showed fingerprints of the Pawn Storm actor group. We believe we were one of the first ones to discover the compromise, and we disclosed it responsibly to US authorities immediately. Within hours after we reported the issue, the compromise was addressed and the DCCC website got cleaned up.

There have been instances when Pawn Storm uses mainstream media to get the general public to know about their brazen attacks. It has been confirmed by several mainstream media outlets that they were offered exclusive access to data that was stolen by Pawn Storm.

This shows that apart from WikiLeaks, mainstream media are also attempted to be used by threat actors who want to influence public opinion and cause harm to political organisations.

The US is not the only country where political organisations got targeted in 2016.  In fact, the problem is much more widespread. In April and May 2016 German Chancellor Angela Merkel’s political party, the Christian Democratic Union (CDU), was targeted by Pawn Storm.

We don’t know whether the attacks were successful, but they were confirmed by German authorities. No information has been leaked yet, but in other cases, Pawn Storm waited more than a year before they started to publish stolen data.

Early February 2016 Pawn Storm targeted the Turkish parliament. Other researchers have noted that a particular threat actor targeted political parties between March and August 2016, including the Die Freiheit party in Germany, the AK party in Turkey, and two other parties in Ukraine.

We do not know whether these attacks were carried out by Pawn Storm as well. However, one of the e-mail addresses that was used in these attacks was also targeted and likely compromised by Pawn Storm just a few days before the campaign against the Turkish AK party started. Regardless of who the threat actor was in these cases, it is clear that several political parties outside the US were targeted.

Attacks against political parties are not likely to stop any time soon.

In October 2016, a special credential phishing attack was launched against the parliament of Montenegro, most likely by Pawn Storm once again.

In the spring of 2017, several European countries are scheduled to hold elections, including Bulgaria, France, Germany, the Netherlands, and Norway. Political organisations and other high profile organizations are urged to take measures to avoid becoming the next victim of foreign threat actors who want to influence elections and public opinion.

Trend Micro:       Hackers Target France’s Presidential Election:     

German Spy Chief Fears Russian Interference In 2017 Elections:

 

 

« US Army Wants To 3D-Print Mini-Drones
Nissan Self-Drive Trial Begins In London »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DataGuidance

DataGuidance

DataGuidance is a platform used by privacy professionals to monitor regulatory developments, mitigate risk and achieve global compliance.

InfoSecurity Magazine

InfoSecurity Magazine

Infosecurity Magazine has over ten years of experience providing knowledge and insight into the information security industry.

CyberSecurityJobsite.com

CyberSecurityJobsite.com

CyberSecurityJobsite.com is a specialist job board designed to attract candidates working within Cyber Security, Information Security or Information Assurance.

Software Engineering Institute (SEI)

Software Engineering Institute (SEI)

At the CERT Division of SEI we study and solve cybersecurity problems, research security vulnerabilities in software, and develop information and training to help improve cybersecurity.

Ikarus Security Software

Ikarus Security Software

Ikarus focuses on antivirus and content-security solutions.

North European Cybersecurity Cluster (NECC)

North European Cybersecurity Cluster (NECC)

NECC promotes information security and cybersecurity-related cooperation and collaboration in the Northern European region in order to enhance integration into the European Digital Single Market.

Crosser

Crosser

The Crosser Platform enables real-time processing of streaming or batch data for Industrial IoT, Data Transformation, Analytics, Automation and Integration.

S4x Events

S4x Events

S4x are the most advanced and largest ICS cyber security events in the world.

CSC Digital Brand Services

CSC Digital Brand Services

Our brand protection and security expertise give our customers peace of mind that no matter how fast the digital world changes, their intellectual property and digital assets will be secure.

JupiterOne

JupiterOne

JupiterOne is the security product that is changing how organizations manage and secure their software defined assets.

Trapp Technology

Trapp Technology

Trapp Technology combines the very best cloud, Internet, IT managed services, and IT consulting to provide a true all-in-one IT solution for small to mid-sized businesses.

Financial Services Information Sharing and Analysis Center (FS-ISAC)

Financial Services Information Sharing and Analysis Center (FS-ISAC)

The Financial Services Information Sharing and Analysis Center is the only global cyber intelligence sharing community solely focused on financial services.

SecurIT360

SecurIT360

SecurIT360 is a full-service specialized Cyber Security and Compliance consulting firm.

PixelQA

PixelQA

Are you looking for a security testing company to cross-check whether your software or mobile app has a possible security threat or not?

IT-Schulungen.com / New Elements GmbH

IT-Schulungen.com / New Elements GmbH

Under the name IT-Schulungen.com, the Nuremberg-based New Elements GmbH has been operating one of the largest training centres in the German-speaking world for over 20 years.

STACK Cybersecurity

STACK Cybersecurity

STACK Cybersecurity serves as a strategic partner, guiding you through the intricate and dynamic cybersecurity landscape.