Army wife Angela Ricketts was soaking in a bubble bath in her Colorado home, leafing through a memoir, when a message appeared on her iPhone:<\/p>\n\n\n\n
\u201cDear Angela!\u201d it said. \u201cBloody Valentine\u2019s Day!\u201d<\/p>\n\n\n\n
\u201cWe know everything about you, your husband and your children,\u201d the Facebook message continued, claiming that the hackers operating under the flag of Islamic State militants had penetrated her computer and her phone. \u201cWe\u2019re much closer than you can even imagine.\u201d<\/p>\n\n\n\n
Ricketts was one of five military wives who received death threats from the self-styled CyberCaliphate on the morning of Feb. 10, 2015. The warnings led to days of anguished media coverage of Islamic State militants\u2019 online reach.<\/p>\n\n\n\n
Except it wasn\u2019t ISIS.<\/p>\n\n\n\n
The Associated Press has found evidence that the women were targeted not by jihadists but by the same Russian hacking group that intervened in the American election and exposed the emails of Hillary Clinton\u2019s presidential campaign chairman, John Podesta.<\/p>\n\n\n\n
The false flag is a case study in the difficulty of assigning blame in a world where hackers routinely borrow one another\u2019s identities to throw investigators off track. The operation also parallels the online disinformation campaign by Russian trolls in the months leading up to the U.S. election in 2016.<\/p>\n\n\n\n
Links between CyberCaliphate and the Russian hackers \u2014 typically nicknamed Fancy Bear or APT28 \u2014 have been documented previously. On both sides of the Atlantic, the consensus is that the two groups are closely related.<\/p>\n\n\n\n
But that consensus never filtered through to the women involved, many of whom were convinced they had been targeted by Islamic State sympathizers right up until the AP contacted them.<\/p>\n\n\n\n
\u201cNever in a million years did I think that it was the Russians,\u201d said Ricketts, an author and advocate for veterans and military families. She called the revelation \u201cmind blowing.\u201d<\/p>\n\n\n\n
\u201cIt feels so hilarious and insidious at the same time.\u201d<\/p>\n\n\n\n
\u2018COMPLETELY NEW GROUND\u2019<\/b><\/p>\n\n\n\n
As Ricketts scrambled out of the tub to show the threat to her husband, nearly identical messages reached Lori Volkman, a deputy prosecutor based in Oregon who had won fame as a blogger after her husband deployed to the Middle East; Ashley Broadway-Mack, based in the Washington, D.C., area and head of an association for gay and lesbian military family members; and Amy Bushatz, an Alaska-based journalist who covers spouse and family issues for Military.com.<\/p>\n\n\n\n
Liz Snell, the wife of a U.S. Marine, was at her husband\u2019s retirement ceremony in California when her phone rang. The Twitter account of her charity, Military Spouses of Strength, had been hacked. It was broadcasting public threats not only to herself and the other spouses, but also to their families and then-first lady Michelle Obama.<\/p>\n\n\n\n
Snell flew home to Michigan from the ceremony, took her children and checked into a Comfort Inn for two nights.<\/p>\n\n\n\n
\u201cAny time somebody threatens your family, Mama Bear comes out,\u201d she said.<\/p>\n\n\n\n
The women determined they had all received the same threats. They were also all quoted in a CNN piece about the hacking of a military Twitter feed by CyberCaliphate only a few weeks earlier. In it, they had struck a defiant tone. After they received the threats, they suspected that CyberCaliphate singled them out for retaliation.<\/p>\n\n\n\n
The women refused to be intimidated.<\/p>\n\n\n\n
\u201cFear is exactly what \u2014 at the time \u2014 we perceived ISIS wanted from military families,\u201d said Volkman, using another term for the Islamic State group.<\/p>\n\n\n\n
Volkman was quoted in half a dozen media outlets; Bushatz wrote an article describing what happened; Ricketts, interviewed as part of a Fox News segment devoted to the menace of radical Islam, told TV host Greta Van Susteren that the nature of the threat was changing.<\/p>\n\n\n\n
\u201cMilitary families are prepared to deal with violence that\u2019s directed toward our soldiers,\u201d she said. \u201cBut having it directed toward us is just complete new ground.\u201d<\/p>\n\n\n\n
\u2018WE MIGHT BE SURPRISED\u2019<\/b><\/p>\n\n\n\n
A few weeks after the spouses were threatened, on April 9, 2015, the signal of French broadcaster TV5 Monde went dead.<\/p>\n\n\n\n
The station\u2019s network of routers and switches had been knocked out and its internal messaging system disabled. Pasted across the station\u2019s website and Facebook page was the keffiyeh-clad logo of CyberCaliphate.<\/p>\n\n\n\n
The cyberattack shocked France, coming on the heels of jihadist massacres at the satirical magazine Charlie Hebdo and a kosher supermarket that left 17 dead. French leaders decried what they saw as another blow to the country\u2019s media. Interior Minister Bernard Cazeneuve said evidence suggested the broadcaster was the victim of an act of terror.<\/p>\n\n\n\n
But Guillaume Poupard, the chief of France\u2019s cybersecurity agency, pointedly declined to endorse the minister\u2019s comments when quizzed about them the day after the hack.<\/p>\n\n\n\n
\u201cWe should be very prudent about the origin of the attack,\u201d he told French radio. \u201cWe might be surprised.\u201d<\/p>\n\n\n\n
Government experts poring over the station\u2019s stricken servers eventually vindicated Poupard\u2019s caution, finding evidence they said pointed not to the Middle East but to Moscow.<\/p>\n\n\n\n
Speaking to the AP last year, Poupard said the attack \u201cresembles a lot what we call collectively APT28.\u201d<\/p>\n\n\n\n
Russian officials in Washington and in Moscow did not respond to questions seeking comment. The Kremlin has repeatedly denied masterminding hacks against Western targets.<\/p>\n\n\n\n
\u2018THE MEDIA PLAYED RIGHT INTO IT\u2019<\/b><\/p>\n\n\n\n
Proof that the military wives were targeted by Russian hackers is laid out in a digital hit list provided to the AP by the cybersecurity company Secureworks last year. The AP has previously used the list of 4,700 Gmail addresses to outline the group\u2019s espionage campaign against journalists , defense contractors and U.S. officials . More recent AP research has found that Fancy Bear, which Secureworks dubs \u201cIron Twilight,\u201d was actively trying to break into the military wives\u2019 mailboxes around the time that CyberCaliphate struck.<\/p>\n\n\n\n
Lee Foster, a manager with cybersecurity company FireEye, said the repeated overlap between Russian hackers and CyberCaliphate made it all but certain that the groups were linked.<\/p>\n\n\n\n
\u201cJust think of your basic probabilities,\u201d he said.<\/p>\n\n\n\n
CyberCaliphate faded from view after the TV5 Monde hack, but the over-the-top threats issued by the gang of make-believe militants found an echo in the anti-Muslim sentiment whipped up by the St. Petersburg troll farm \u2014 an organization whose operations were laid bare by a U.S. special prosecutor\u2019s indictment earlier this year.<\/p>\n\n\n\n
The trolls \u2014 Russian employees paid to seed American social media with disinformation \u2014 often hyped the threat of Islamic State militants to the United States. A few months before CyberCaliphate first won attention by hijacking various media organizations\u2019 Twitter accounts, for example, the trolls were spreading false rumors about an Islamic State attack in Louisiana and a counterfeit video appearing to show an American soldier firing into a Quran .<\/p>\n\n\n\n
The AP has found no link between CyberCaliphate and the St. Petersburg trolls, but their aims appeared to be the same: keep tension at a boil and radical Islam in the headlines.<\/p>\n\n\n\n
By that measure, CyberCaliphate\u2019s targeting of media outlets like TV5 Monde and the military spouses succeeded handily.<\/p>\n\n\n\n
Ricketts, the author, said that by planting threats with some of the most vocal members of the military community, CyberCaliphate guaranteed maximum press coverage.<\/p>\n\n\n\n
\u201cNot only did we play right into their hands by freaking out, but the media played right into it,\u201d she said. \u201cWe reacted in a way that was probably exactly what they were hoping for.\u201d<\/p>\n\n\n\n
Satter reported from Paris. Associated Press writers Michael Conroy in Bloomington, Indiana; Jeff Donn in Plymouth, Massachusetts; and Desmond Butler in Washington contributed to this report.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
Army wife Angela Ricketts was soaking in a bubble bath in her Colorado home, leafing through a memoir, when a message appeared on her iPhone from hackers threatening to slaughter her family.<\/p>\n","protected":false},"author":7,"featured_media":112084,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":70,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[100,12,25,70],"tags":[],"coauthors":[7464],"class_list":["post-85623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-news-roundup","category-news","category-newsletters","category-your-army"],"acf":{"subheadline":"","legacy_arc_id":"SZ4ITXNEJJEWBEUPHBH5FVOG3Q","arc_canonical_url":"\/dod\/2018\/05\/08\/us-military-wives-threatened-by-russian-hackers-posing-as-is\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n