Microsoft blocks Russian 'Fancy Bear' attempt to phish Congress in run-up to US mid-term elections

MIcrosoft claims to have stopped a new attempt by hackers traced to the Russian state to interfere in the upcoming mid-term elections in the US.

The intervention came before the first attacks, intended to phish for user names and passwords of Congressmen and think tanks, were even launched. 

Microsoft believes that the phishing sites are linked to Russian state hackers dubbed Fancy Bear.

The company claims that the group was targeting two politically right-of-centre think tanks in particular. Microsoft claims that the group had designed their own web pages for the two think tanks, which mimic their design, and were planning on running a phishing campaign to net user names and passwords.

Three other fake domains were designed to look as if they belonged to the US Senate, the company added.

According to Brad Smith, Microsoft's president and chief legal officer, "Microsoft's Digital Crimes Unit (DCU) successfully executed a court order to disrupt and transfer control of six internet domains created by a group widely associated with the Russian government and known as Strontium, or alternatively Fancy Bear or APT28."

He continued: "We have now used this approach 12 times in two years to shut down 84 fake websites associated with this group. Attackers want their attacks to look as realistic as possible and they therefore create websites and URLs that look like sites their targeted victims would expect to receive email from or visit."

The internet domains that Microsoft seized were:

• my-iri.org
• hudsonorg-my-sharepoint.com
• senate.group
• adfs-senate.services
• adfs-senate.email
• office365-onedrive.com

Smith stressed that there was no evidence that these domains have been used in any attacks so far, but revealed that it has been actively monitoring "domain activity with Senate IT staff the past several months, following prior attacks we detected on the staffs of two current senators"

Smith used the news to announce that Microsoft would be expanding its "Defending Democracy Program with a new initiative called Microsoft AccountGuard".

This will "provide state-of-the-art cybersecurity protection at no extra cost to all candidates and campaign offices at the federal, state and local level, as well as think tanks and political organizations we now believe are under attack. The technology is free of charge to candidates, campaigns and related political institutions using Office 365".

Earlier this year, Trend Micro warned that the US Senate was being targeted by Russia's Fancy Bear group, also in a phishing campaign. 

Computing's Cloud & Infrastructure Summit Live returns on Wednesday 19 September, featuring panel discussions with end-users, strategic and technical streams and a session with guest speaker Inma Martinez. The event is FREE to qualifying IT leaders and senior IT pros, but places are going fast. Register now!

Further reading

• Security

Apple fanboy hacks company network - saves purloined files in folder called 'hacky hack hack'

• 17 Aug 2018

• Security

IAAF cracked by Russia-linked APT28 'Fancy Bear' hackers

• 03 Apr 2017

• Security

Microsoft blames Russian 'Fancy Bear' hackers for exploiting Windows flaw

• 02 Nov 2016

• Security

Fancy Bear Russian hacking group turns X-Agent Trojan against macOS users

• 15 Feb 2017

• Tweet  
• Facebook  
•  
•  
• Send to  

• Topics
• Security
• Microsoft
• fancy bear
• Brad Smith
• Russia
• Strontium
• APT28