PARIS (AP) \u2014 Russian television anchor Pavel Lobkov was in the studio getting ready for his show when jarring news flashed across his phone: Some of his most intimate messages had just been published to the web.<\/p>\n\n\n\n
Days earlier, the veteran journalist had come out live on air as HIV-positive, a taboo-breaking revelation that drew responses from hundreds of Russians fighting their own lonely struggles with the virus. Now he\u2019d been hacked.<\/p>\n\n\n\n
\u201cThese were very personal messages,\u201d Lobkov said in a recent interview, describing a frantic call to his lawyer in an abortive effort to stop the spread of nearly 300 pages of Facebook correspondence, including sexually explicit messages. Even two years later, he said, \u201cit\u2019s a very traumatic story.\u201d<\/p>\n\n\n\n
The Associated Press found that Lobkov was targeted by the hacking group known as Fancy Bear in March 2015, nine months before his messages were leaked. He was one of at least 200 journalists, publishers and bloggers targeted by the group as early as mid-2014 and as recently as a few months ago.<\/p>\n\n\n\n
The AP identified journalists as the third-largest group on a hacking hit list obtained from cybersecurity firm Secureworks, after diplomatic personnel and U.S. Democrats. About 50 of the journalists worked at The New York Times. Another 50 were either foreign correspondents based in Moscow or Russian reporters like Lobkov who worked for independent news outlets. Others were prominent media figures in Ukraine, Moldova, the Baltics or Washington.<\/p>\n\n\n\n
The list of journalists provides new evidence for the U.S. intelligence community\u2019s conclusion that Fancy Bear acted on behalf of the Russian government when it intervened in the U.S. presidential election. Spy agencies say the hackers were working to help Republican Donald Trump. The Russian government has denied interfering in the American election.<\/p>\n\n\n\n
Previous AP reporting has shown how Fancy Bear \u2014 which Secureworks nicknamed Iron Twilight \u2014 used phishing emails to try to compromise Russian opposition leaders, Ukrainian politicians and U.S. intelligence figures, along with Hillary Clinton campaign chairman John Podesta and more than 130 other Democrats.<\/p>\n\n\n\n
Lobkov, 50, said he saw hacks like the one that turned his day upside-down in December 2015 as dress rehearsals for the email leaks that struck the Democrats in the United States the following year.<\/p>\n\n\n\n
\u201cI think the hackers in the service of the Fatherland were long getting their training on our lot before venturing outside.\u201d<\/p>\n\n\n\n
\u201cClassic KGB tactic\u201d<\/b><\/p>\n\n\n\n
New Yorker writer Masha Gessen said it was also in 2015 \u2014 when Secureworks first detected attempts to break into her Gmail \u2014 that she began noticing people who seemed to materialize next to her in public places in New York and speak loudly in Russian into their phones, as if trying to be overheard. She said this only happened when she put appointments into the online calendar linked to her Google account.<\/p>\n\n\n\n
Gessen, the author of a book about Russian President Vladimir Putin\u2019s rise to power, said she saw the incidents as threats.<\/p>\n\n\n\n
\u201cIt was really obvious,\u201d she said. \u201cIt was a classic KGB intimidation tactic.\u201d<\/p>\n\n\n\n
Other U.S.-based journalists targeted include Josh Rogin, a Washington Post columnist, and Shane Harris, who was covering the intelligence community for The Daily Beast in 2015. Harris said he dodged the phishing attempt, forwarding the email to a source in the security industry who told him almost immediately that Fancy Bear was involved.<\/p>\n\n\n\n
In Russia, the majority of journalists targeted by the hackers worked for independent news outlets like Novaya Gazeta or Vedomosti, though a few \u2014 such as Tina Kandelaki and Ksenia Sobchak \u2014 are more mainstream. Sobchak has even launched an improbable bid for the Russian presidency.<\/p>\n\n\n\n
Investigative reporter Roman Shleynov noted that the Gmail hackers targeted was the one he used while working on the Panama Papers, the expose of international tax avoidance that implicated members of Putin\u2019s inner circle.<\/p>\n\n\n\n
Fancy Bear also pursued more than 30 media targets in Ukraine, including many journalists at the Kyiv Post and others who have reported from the front lines of the Russia-backed war in the country\u2019s east.<\/p>\n\n\n\n
Nataliya Gumenyuk, co-founder of Ukrainian internet news site Hromadske, said the hackers were hunting for compromising information.<\/p>\n\n\n\n
\u201cThe idea was to discredit the independent Ukrainian voices,\u201d she said.<\/p>\n\n\n\n
The hackers also tried to break into the personal Gmail account of Ellen Barry, The New York Times\u2019 former Moscow bureau chief.<\/p>\n\n\n\n
Her newspaper appears to have been a favorite target. Fancy Bear sent phishing emails to roughly 50 of Barry\u2019s colleagues at The Times in late 2014, according to two people familiar with the matter. They spoke on condition of anonymity to discuss confidential data.<\/p>\n\n\n\n
The Times confirmed in a brief statement that its employees received the malicious messages, but the newspaper declined to comment further.<\/p>\n\n\n\n
Some journalists saw their presence on the hackers\u2019 hit list as vindication. Among them were CNN security analyst Michael Weiss and Brookings Institution visiting fellow Jamie Kirchick, who took the news as a badge of honor.<\/p>\n\n\n\n
\u201cI\u2019m very proud to hear that,\u201d Kirchick said.<\/p>\n\n\n\n
The Committee to Protect Journalists said the wide net cast by Fancy Bear underscores efforts by governments worldwide to use hacking against journalists.<\/p>\n\n\n\n
\u201cIt\u2019s about gaining access to sources and intimidating those journalists,\u201d said Courtney C. Radsch, the group\u2019s advocacy director.<\/p>\n\n\n\n
In Russia, the stakes are particularly high. The committee has counted 38 murders of journalists there since 1992.<\/p>\n\n\n\n
Many journalists told the AP they knew they were under threat, explaining that they had added a second layer of password protection to their emails and only chatted over encrypted messaging apps like Telegram, WhatsApp or Signal.<\/p>\n\n\n\n
Fancy Bear target Ekaterina Vinokurova, who works for regional media outlet Znak, said she routinely deletes her emails.<\/p>\n\n\n\n
\u201cI understand that my accounts may be hacked at any time,\u201d she said in a telephone interview. \u201cI\u2019m ready for them.\u201d<\/p>\n\n\n\n
\u201cI\u2019ve seen what they could do\u201d<\/b><\/p>\n\n\n\n
It\u2019s not just whom the hackers tried to spy on that points to the Russian government.<\/p>\n\n\n\n
It\u2019s when.<\/p>\n\n\n\n
Maria Titizian, an Armenian journalist, immediately found significance in the date she was targeted: June 26, 2015.<\/p>\n\n\n\n
\u201cIt was Electric Yerevan,\u201d she said, referring to protests over rising energy bills that she reported on. The protests that rocked Armenia\u2019s capital that summer were initially seen by some in Moscow as a threat to Russian influence.<\/p>\n\n\n\n
Titizian said her outspoken criticism of the Kremlin\u2019s \u201ccolonial attitude\u201d toward Armenia could have made her a target.<\/p>\n\n\n\n
Eliot Higgins, whose open source journalism site Bellingcat repeatedly crops up on the target list, said the phishing attempts seemed to begin \u201conce we started really making strong statements about MH17,\u201d the Malaysian airliner shot out of the sky over eastern Ukraine in 2014, killing 298 people. Bellingcat played a key role in marshaling the evidence that the plane was destroyed by a Russian missile \u2014 Moscow\u2019s denials notwithstanding.<\/p>\n\n\n\n
The clearest timing for a hacking attempt may have been that of Adrian Chen.<\/p>\n\n\n\n
On June 2, 2015, Chen published a prescient expose of the Internet Research Agency, the Russian \u201ctroll factory\u201d that won fresh infamy in October over revelations that it had manufactured make-believe Americans to pollute social media with toxic rhetoric.<\/p>\n\n\n\n
Eight days after Chen published his big story, Fancy Bear tried to break into his account.<\/p>\n\n\n\n
Chen, who has regularly written about the darker recesses of the internet, said having a lifetime of private messages exposed to the internet could be devastating.<\/p>\n\n\n\n
\u201cI\u2019ve covered a lot of these leaks,\u201d he said. \u201cI\u2019ve seen what they could do.\u201d<\/p>\n\n\n\n
Donn reported from Plymouth, Massachusetts. Vasilyeva reported from Moscow. Kate de Pury in Moscow contributed.<\/i><\/p>\n\n\n\n
___<\/p>\n\n\n\n
EDITOR\u2019S NOTE \u2014 Raphael Satter\u2019s father, David Satter, is an author and Russia specialist who has been critical of the Kremlin. His emails were published last year by hackers and his account is on Secureworks\u2019 list of Fancy Bear targets.<\/i><\/p>\n\n\n\n
The AP identified journalists as the third-largest group on a hacking hit list obtained from cybersecurity firm Secureworks, after diplomatic personnel and U.S. Democrats.<\/p>\n","protected":false},"author":7,"featured_media":55061,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[1145,1066,2879],"class_list":["post-17717","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"HNZ5OHAC6JEA3F7YN244M6ATEE","arc_canonical_url":"\/international\/2017\/12\/22\/russian-hackers-targeted-more-than-200-journalists-globally\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n