PARIS \u2014 The same Russian government-aligned hackers who penetrated the Democratic Party have spent the past few months laying the groundwork for an espionage campaign against the U.S. Senate, a cybersecurity firm said Friday.<\/p>\n\n\n\n
The revelation suggests the group often nicknamed Fancy Bear, whose hacking campaign scrambled the 2016 U.S. electoral contest, is still busy trying to gather the emails of America\u2019s political elite.<\/p>\n\n\n\n
\u201cThey\u2019re still very active \u2014 in making preparations at least \u2014 to influence public opinion again,\u201d said Feike Hacquebord, a security researcher at Trend Micro Inc., which published the report . \u201cThey are looking for information they might leak later.\u201d<\/p>\n\n\n\n
The Senate Sergeant at Arms office, which is responsible for the upper house\u2019s security, declined to comment.<\/p>\n\n\n\n
Hacquebord said he based his report on the discovery of a clutch of suspicious-looking websites dressed up to look like the U.S. Senate\u2019s internal email system. He then cross-referenced digital fingerprints associated with those sites to ones used almost exclusively by Fancy Bear, which his Tokyo-based firm dubs \u201cPawn Storm.\u201d<\/p>\n\n\n\n
Trend Micro previously drew international attention when it used an identical technique to uncover a set of decoy websites apparently set up to harvest emails from the French presidential candidate Emmanuel Macron\u2019s campaign in April 2017. The sites\u2019 discovery was followed two months later by a still-unexplained publication of private emails from several Macron staffers in the final days of the race.<\/p>\n\n\n\n
Hacquebord said the rogue Senate sites \u2014 which were set up in June and September of 2017 \u2014 matched their French counterparts.<\/p>\n\n\n\n
\u201cThat is exactly the way they attacked the Macron campaign in France,\u201d he said.<\/p>\n\n\n\n
Attribution is extremely tricky in the world of cybersecurity, where hackers routinely use misdirection and red herrings to fool their adversaries. But Tend Micro, which has followed Fancy Bear for years, said there could be no doubt.<\/p>\n\n\n\n
\u201cWe are 100 percent sure that it can attributed to the Pawn Storm group,\u201d said Rik Ferguson, one of the Hacquebord\u2019s colleagues.<\/p>\n\n\n\n
Like many cybersecurity companies, Trend Micro refuses to speculate publicly on who is behind such groups, referring to Pawn Storm only as having \u201cRussia-related interests.\u201d But the U.S. intelligence community alleges that Russia\u2019s military intelligence service pulls the hackers\u2019 strings and a months-long Associated Press investigation into the group, drawing on a vast database of targets supplied by the cybersecurity firm Secureworks, has determined that the group is closely attuned to the Kremlin\u2019s objectives.<\/p>\n\n\n\n
If Fancy Bear has targeted the Senate over the past few months, it wouldn\u2019t be the first time. An AP analysis of Secureworks\u2019 list shows that several staffers there were targeted between 2015 and 2016.<\/p>\n\n\n\n
Among them: Robert Zarate, now the foreign policy adviser to Florida Senator Marco Rubio; Josh Holmes, a former chief of staff to Senate Majority Leader Mitch McConnell who now runs a Washington consultancy; and Jason Thielman, the chief of staff to Montana Senator Steve Daines. A Congressional researcher specializing in national security issues was also targeted.<\/p>\n\n\n\n
Fancy Bear\u2019s interests aren\u2019t limited to U.S. politics; the group also appears to have the Olympics in mind.<\/p>\n\n\n\n
Trend Micro\u2019s report said the group had set up infrastructure aimed at collecting emails from a series of Olympic winter sports federations, including the International Ski Federation, the International Ice Hockey Federation, the International Bobsleigh & Skeleton Federation, the International Luge Federation and the International Biathlon Union.<\/p>\n\n\n\n
The targeting of Olympic groups comes as relations between Russia and the International Olympic Committee are particularly fraught. Russian athletes are being forced to compete under a neutral flag in the upcoming Pyeongchang Olympics following an extraordinary doping scandal that has seen 43 athletes and several Russian officials banned for life. Amid speculation that Russia could retaliate by orchestrating the leak of prominent Olympic officials\u2019 emails, cybersecurity firms including McAfee and ThreatConnect have picked up on signs that state-backed hackers are making moves against winter sports staff and anti-doping officials.<\/p>\n\n\n\n
On Wednesday, a group that has brazenly adopted the Fancy Bear nickname began publishing what appeared to be Olympics and doping-related emails from between September 2016 and March 2017. The contents were largely unremarkable but their publication was covered extensively by Russian state media and some read the leak as a warning to Olympic officials not to press Moscow too hard over the doping scandal.<\/p>\n\n\n\n
Whether any Senate emails could be published in such a way isn\u2019t clear. Previous warnings that German lawmakers\u2019 correspondence might be leaked by Fancy Bear ahead of last year\u2019s election there appear to have come to nothing.<\/p>\n\n\n\n
On the other hand, the group has previously dumped at least one U.S. legislator\u2019s correspondence onto the web.<\/p>\n\n\n\n
One of the targets on Secureworks\u2019 list was Colorado State Senator Andy Kerr, who said thousands of his emails were posted to an obscure section of the website DCLeaks \u2014 a web portal better known for publishing emails belonging to retired Gen. Colin Powell and various members of Hillary Clinton\u2019s campaign \u2014 in late 2016.<\/p>\n\n\n\n
Kerr said he was still bewildered as to why he was targeted. He said that while he supported transparency, \u201cthere should be some process and some system to it.<\/p>\n\n\n\n
\u201cIt shouldn\u2019t be up to a foreign government or some hacker to say what gets released and what shouldn\u2019t.\u201d<\/p>\n\n\n\n
In a statement, Republican Sen. Ben Sasse of Nebraska said, \u201cRussia is just getting started and the hacks, forgeries, and influence campaigns are going to get more and more sophisticated. Moscow wants to undermine America\u2019s trust in our institutions and Putin couldn\u2019t be happier with Washington\u2019s obsession with making everything about settling partisan scores instead of preparing for 2018 and 2020.\u201d<\/p>\n\n\n\n
James Ellingworth in Moscow contributed to this report.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
Fancy Bear, the group whose hacking campaign scrambled the 2016 U.S. electoral contest, is “still very active \u2014 in making preparations at least \u2014 to influence public opinion again,\u201d said Feike Hacquebord, a security researcher at Trend Micro Inc., which published the report. \u201cThey are looking for information they might leak later.\u201d<\/p>\n","protected":false},"author":7,"featured_media":63049,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":4109,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["it-networks","home","daily-brief","newsletters","it-cloud-report"],"primary_category":"it-networks"}}},"categories":[4109,106,29,32],"tags":[],"coauthors":[1145],"class_list":["post-21321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-congress","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"EHPZY7Y24JDLLHQR32YSKB6P6Y","arc_canonical_url":"\/congress\/2018\/01\/12\/cybersecurity-firm-us-senate-in-russian-hackers-crosshairs\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n