NSA alerted France to 'Russian activity' against presidential campaign targets, Rogers says

We said, 'Look we are watching the Russians, we've seen them penetrate your infrastructure, here's what we've seen, what can we do to try to assist?'

The U.S. National Security Agency tracked Russian hackers working against French political targets and then alerted French authorities prior to the “massive and coordinated hack” against the campaign of President-elect Emmanuel Macron, the NSA’s chief said Tuesday.

Macron won convincingly even though the hack resulted in a massive email dump about a day before French voters headed to the polls, but upcoming crucial elections across Europe have raised alert levels for Western intelligence agencies tasked with fighting Russian interference.

Adm. Michael Rogers, who leads both the U.S. Cyber Command and the NSA, testified before the Senate Armed Services Committee on Tuesday. He was asked about the United States’ role in protecting elections inside and outside of U.S. borders.

“We had become aware of Russian activity,” Rogers said. “We had talked to our French counterparts prior to the public announcements of the events that were publicly attributed this past weekend. We said, ‘Look we are watching the Russians, we’ve seen them penetrate your infrastructure, here’s what we’ve seen, what can we do to try to assist?’ We’re doing similar things with our German and British counterparts, they have an upcoming election sequence. We’re all trying to figure out how we can learn from each other. That’s much more my NSA role than my Cyber Command role.”

The three biggest European elections remaining this year are French legislative contests on June 11 and 18, United Kingdom’s general election on June 8 and the German federal election on Sept. 24.

Experts both inside and outside of government expect continued Russian action in the cyber domain. In addition to escalating American information warfare and hardening critical systems, Rogers said one key aspect of defense is to make Russia and other hostile actors face significant consequences for attacks. He did not specify exactly what that would mean.

“If this is APT28, then they have not abandoned this tool,” John Hultquist, a senior analyst at the cybersecurity firm FireEye, told CyberScoop. “We can anticipate they’ll continue to use it until the consequences for these actions are greater.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure