On October 4th, Microsoft announced that it has discovered a threat group it calls Phosphorus which is allegedly targeting the...
The post Alleged Iranian Hackers Target 2020 US Campaign: Microsoft Claims appeared first on .
Illustrative: A cybersecurity expert stands in front of a map of Iran as he speaks to journalists about the techniques of Iranian hacking, September 20, 2017, in Dubai, United Arab Emirates. (AP Photo/Kamran Jebreili)
On October 4th, Microsoft announced that it has discovered a threat group it calls Phosphorus which is allegedly targeting the US 2020 Presidential Elections.
In a surprise twist, it’s not Russian, but according to the company it originates from Iran and has ties to the Iranian government.
The information on Phosphorus’ activity was collected in a 30-day period between August and September 2019.
The Microsoft Threat Intelligence Center (MSTIC) observed Phosphorus making more than 2,700 attempts to identify consumer email accounts belonging to specific Microsoft customers and then attack 241 of those accounts.
“The targeted accounts are associated with a U.S. presidential campaign, current and former U.S. government officials, journalists covering global politics and prominent Iranians living outside Iran. Four accounts were compromised as a result of these attempts; these four accounts were not associated with the U.S. presidential campaign or current and former U.S. government officials. Microsoft has notified the customers related to these investigations and threats and has worked as requested with those whose accounts were compromised to secure them.”
Essentially, the group allegedly only compromised accounts that had nothing to do with the elections.
This information was shared for two reasons:
- “First, it is important that we all – governments and private sector – are increasingly transparent about nation-state attacks and efforts to disrupt democratic processes.”
- “Second, while we have processes to notify customers about nation state activity and have AccountGuard to monitor accounts of campaigns and other associated organizations related to election processes in democracies around the world, publishing this information should help others be more vigilant and take steps to protect themselves.”
Notably, the alleged attacks were quite unsophisticated, according to Microsoft the group simply researched their targets or used other means to overcome password reset functions of their accounts.
“While the attacks we’re disclosing today were not technically sophisticated, they attempted to use a significant amount of personal information both to identify the accounts belonging to their intended targets and in a few cases to attempt attacks,” Tom Burt, Microsoft’s corporate vice president of customer security and trust said in the blog post. “It is important that we all—governments and private sector—are increasingly transparent about nation-state attacks and efforts to disrupt democratic processes.”
Finally, Microsoft advertised its AccountGuard system, saying that it is part of the Defending Democracy Program. Any person or entity that is a part of a political campaign, a political party committee or an NGO or think tank working on issues related to democracy is eligible to take part.
Iran allegedly increased its malign activity online starting from October 2017, according to cybersecurity intelligence firm Treadstone 71. It all goes back to the “success” of the “Russian election interference” campaign leading up to the 2016 Presidential elections in the US.
Despite there being no evidence of any such campaign (Russian in 2016, or Iranian in 2020).
“Due to the success of the Russians in the 2016 US election, their model is being emulated across the globe,” says Jeff Bardin, chief intelligence officer of the cybersecurity intelligence firm Treadstone 71, which monitors Iranian hacking activity. “In terms of who Iran might target in the US, you would have to ask yourself what candidate or candidates would best suit Iranian needs as a president of the United States. And the interesting thing with that is that Iran’s effort would likely be counter to the efforts of Russian cyber-operations and those of other countries. So what you end up having is the potential for numerous massive attempts to manipulate the American voter that may turn to absolute noise and contradictory data.”
MORE ON THE TOPIC:
The post Alleged Iranian Hackers Target 2020 US Campaign: Microsoft Claims appeared first on .
