Report: Evidence shows Russia also involved in state election hacking

Security researchers believe they have uncovered a piece of digital forensic evidence that suggests Russia may have been involved in the recently disclosed hacking of two state voter databases in the U.S.

Security researchers believe they have uncovered a piece of digital forensic evidence suggesting Russia may have been involved in the recently disclosed hacking of two state voter databases in the U.S.

A common pattern has emerged between those attacks aimed at American voter information and a series of past email phishing campaigns targeting Turkish, Ukrainian and German political figures, which “fits a known Russian targeting focus,” according to Arlington, Va.-based cybersecurity firm ThreatConnect.

Earlier this week, a private FBI flash alert — intended for state and private sector cybersecurity partners — was published by Yahoo, bringing to light those attacks against voter databases in Illinois and Arizona. One of the eight Internet Protocol addresses that was identified in the FBI alert is familiar to ThreatConnect because it was used in the aforementioned spear phishing campaign in Turkey, Ukraine and Germany.

“As we explored malicious activity in the IP ranges around 5.149.249[.]172 we found additional linkages back to activity that could be evidence of Russian advanced persistent threat (APT) activity,” ThreatConnect’s research team wrote in a blog post. “This connection around the 5.149.249[.]172 activity is more suggestive of state-backed rather than criminally motivated activity.”

Other factors linking the attack back to Russia, include: six of the eight IP addresses noted by the FBI belong to a Russian-owned hosting service and this exact IP in question — 5.149.249[.]172 — previously hosted a Russian cybercrime market from January to May 2015, ThreatConnect found.

The research report, published on Friday, follows just one day after Bloomberg News conducted an interview with Russia President Vladimir Putin, in which the former Russian intelligence officer denied any and all government involvement in the Democratic National Committee’s data breach.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure