Russian phishing sites targeted conservatives, Senate
Add Axios as your preferred source to
see more of our stories on Google.
Microsoft's Russian headquarters, as seen at night. Photo: Mikhail Tereshchenko/TASS via Getty Images
Microsoft last week seized six potential phishing domains associated with the Kremlin-backed hackers Fancy Bear, who tampered with the 2016 election and likely intended to target two conservative groups and the U.S. Senate. It appears Microsoft shut down the domains before they were ever actively used. Microsoft announced the move in a blog post early Tuesday morning.
Why it matters: Spies have infiltrated legislative bodies and political groups from time immemorial, usually for boring reasons, like getting an edge in trade negotiations. But Russia's mass public dumping of stolen documents in 2016 broke the norms of espionage. Whatever the motivation for Russian attempts to hack influential political figures' emails in 2018, the current climate will lead people to assume the worst.
Microsoft targeted six domains Fancy Bear registered to use in phishing attacks:
- my-iri.org, meant to look like International Republican Institute, a pro-democracy group with multiple sitting and former Republican officials on its board
- hudsonorg-my-sharepoint.com, which was meant to look like the conservative Hudson Institute think tank's Sharepoint document storage system
- Three domains targeting the Senate, including its email servers, and one targeting users of Office 365
This undercuts a narrative: Prior to the 2016 elections, Russia hacked both Democrats and Republicans, yet only released files that harmed Democrats. Microsoft's moves suggest that Russia continues to hack both sides of the aisle.
Be smart: "Russians are hacking the GOP" doesn't necessarily equal "Russians are hacking Trump." Both Hudson and IRI are well known conservative groups. Neither is closely identified with Trump administration policies.
Microsoft has waged a years-long battle with Fancy Bear over phishing sites sites that appear to be legitimate Microsoft sites. The company use civil courts to take control control of the look-alike website names the Russians have registered.
- At the Aspen Security Forum in July, Microsoft announced it had dismantled a similar site targeting a senatorial candidate — later discovered to be Sen. Claire McCaskill (D-Missouri).
Microsoft made this announcement as it launches new security measures for campaigns, NGOs and other groups involved in elections.
The new AccountGuard program will provide:
- Account security across personal and campaign accounts. This is critical, as we learned in 2016, when John Podesta's personal email was hacked.
- Educational opportunities.
- Early access for campaigns to new security tools as Microsoft rolls them out.
