SecureWorks’ Counter Threat Unit research team (CTU) has recently released new cyber research showing that Russian hackers, which the CTU believes is working on behalf of the Russian government, has been targeting key staff members working for the Hillary for America presidential campaign.
The CTU is calling this Russian hacker group, Threat Group (TG-4127)
Utilising spearphishing emails containing Bitly links, used to shorten malicious URLs, TG-4127 attempted to redirect campaign employees to a controlled URL that spoofed a legitimate Google login page. If the target then entered their Google credentials, TG-4127 can then use those entered credentials to access the victim’s corresponding campaign Gmail account.
By exploiting the Hillary for America campaign mail solution, which uses Gmail, and website (www.hillaryclinton.com), TG-4127 targeted campaign employees’ to access their email account. Further observations from CTU researchers found:
- The first short links targeting hillaryclinton.com email addresses begun being created in mid-March 2016; the last link was created in mid-May
- TG-4127 created 213 short links targeting 108 email addresses of staff members on the hillaryclinton.com domain. Bitly Data reveals:
- 20 of the 213 short links have been clicked
- 11 links were clicked once
- 8 were clicked twice or more
- CTU researchers identified the owners of 66 of the targeted hillaryclinton.com email addresses. The identified target email owners held the following titles:
- National political director
- Finance director
- Directors of strategic communications, scheduling, and travel
- Traveling press secretary
- There was no open-source footprint for the remaining 42 addresses, suggesting that TG-4127 acquired them from another source, possibly other intelligence activity
Alex Tilley, Senior Security Researcher, SecureWorks Counter Threat Unit, said “It is well known, that users rarely check for the full URL associated with short links, this allows hackers to utilise URL-shortening services to effectively hide malicious URLs. Businesses need to ensure they are taking the appropriate precautions to minimise the risk of these types of attacks.
“It is important to educate users about the risks of spearphishing emails and how to exercise due diligence when faced with a shortened link, especially in unsolicited email messages. Businesses using Gmail as a corporate mail solution, should educate users about the risk of spoofed login pages and encourage them to confirm they are on the legitimate Google Accounts page when presented with a Google login prompt,” Tilley continued.
TG-4127 has also been observed to target individuals in Russia and the former Soviet states, current and former military and government personnel in the U.S. and Europe, individuals working in the defence and government supply chain, and authors and journalists.
