How phishing emails sent by Russian hackers produce propaganda

A new research report authored by the Citizen Lab shows that hackers with suspected ties to the Russian government play a vital part in international disinformation campaigns.

In late 2015, former Director of National Intelligence James Clapper famously warned of a future where adversaries will often “change or manipulate electronic information in order to compromise its integrity” rather than simply steal data. Since then, the world has watched the Kremlin carry out Clapper’s prediction, interfering in democratic processes around the world.

A new report released this week by the Citizen Lab at the University of Toronto’s Munk School of Global Affairs shows how Russia has made Clapper’s prediction a reality. The research gives a new view on how hackers with suspected ties to the Russian government play a vital part in international disinformation campaigns aimed to discredit enemies of the state and sow discord.

The report, “Tainted Leaks: Disinformation and Phishing With a Russian Nexus,” underscores how offensive cybersecurity operations have become a critical tool used by governments to weaponize information and affect public opinion.

Hackers acting in the apparent interest of the Russian government are actively sending phishing emails, and manipulating leaked information in some cases, in more than 28 countries, Citizen Lab found. At least 200 individuals living across the globe, including a former Russian prime minister and Ukrainian military official, were identified as being sent related booby-trapped emails.

This campaign has already targeted a variety of victims and sectors, including governments, industry, military, media and civil society groups. The approach and techniques used in the operation appear similar to recent digital attacks on French President Emmanuel Macron’s campaign, according to data collected by Citizen Lab.

In one case, a prominent journalist working to expose corruption in the Russian government was successfully targeted, hacked and had his emails leaked. Notably, some of these documents contained falsified information mixed with authentic messages. The result played out in state-owned media, where some Russian news outlets selectively reported on certain information supposedly taken from the inbox of David Satter, a renowned journalist and author.

Satter originally received a nondescript phishing email last October, which researchers now believe effectively served as the first step in a complex and expansive propaganda effort.

Central to the Satter incident is this group CyberBerkut, an entity shrouded in mystery that has been actively involved in a cross-border information operation aimed at shifting public opinion cornering Russian occupation in Ukraine.

One email shared by CyberBerkut described a conspiracy by Satter to plant misleading and scandalous news articles in local publications that opposed the Russian government. The email proved to be fake, Citizen Lab found. RIA Novosti and Sputnik Radio picked up the story and reported the leaked email showed a CIA plot to discredit Russian officials.

The report also notes digital evidence linking CyberBerkut to APT28, or Fancy Bear, an infamous hacking group that became well known last year after breaking into the files of the Democratic National Committee. By analyzing a URL shortening service used by both threat actors named tiny.cc, researchers found a series of commonalities tied to a single user. One of the URLs created by this single user was used in phishing emails sent to journalists working for independent news outlet Bellingcat.

While the evidence is inconclusive, the research adds to a mountain of information published in recent months by a cohort of other security researchers that detail the known activities and tools commonly employed by Russian hackers.

“We have no conclusive evidence that links these operations to a particular Russian government agency; however, there is clear overlap between our evidence and that presented by numerous industry and government reports concerning Russian-affiliated threat actors,” the report reads.

Unusually patient suspected Russian hackers pose as State Department in ‘sophisticated’ attacks on researchers

They weren’t in any hurry, according to Citizen Lab, and used an interesting attack vector. Google Threat Intelligence Group also provided details on the attacks.

Collective of anti-disinformation ‘Elves’ offer a bulwark against Russian propaganda

Ex-US ambassador, anti-corruption activists in Ukraine were targets of suspected Russian phishing

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure