George Soros
Russia’s Election Hackers Are Back—and Targeting George Soros
ENCORE PERFORMANCE–2019
The Kremlin’s targeting of George Soros and his organization carries echoes of 2016, when the GRU dumped 2,500 files stolen from the Open Society Foundations.
Last month Microsoft quietly seized a new batch of 10 deceptive domain names the company says were set up by the hackers known as Fancy Bear, the group intelligence officials and independent analysts have long attributed to Russia’s Main Intelligence Directorate, the GRU. Those web addresses imitate genuine domains used for Microsoft services like Sharepoint, an unmistakable sign that they were intended for use in phishing attacks, in which a victim is tricked into typing their password into a fake login page.
One domain targets a Singapore-based investment firm, and another references the Berlin anti-corruption organization Transparency International, which Russia has targeted before. Others are generic or ambiguous in their targeting. But one seized domain, soros-my-sharepoint[.]com, jumps out as a clear reference to Soros, a past GRU target from Russia’s 2016 election interference.
An additional four phishing domains registered in the same time frame appear to target Soros’ Open Society Foundations, said Kyle Ehmke, an intelligence researcher at the Arlington, Virginia-based cybersecurity firm ThreatConnect. Those domains haven’t been seized and ThreatConnect hasn’t found enough evidence to definitively link them to the Russian hackers, said Ehmke.
The Kremlin’s targeting of Soros and his organization carries echoes of 2016, when the GRU dumped 2,500 files stolen from the Open Society Foundations for the debut of “DC Leaks”, the fake leak site the spies created for their 2016 election interference campaign.
“SOROS INTERNAL FILES – BIG DATA”, the site announced at the time.
Some of the stolen files were reportedly altered to create the appearance that Soros was secretly financing Russian opposition candidates, making the leak politically useful to Vladmir Putin. More importantly, the Soros dump earned DC Leaks instant credibility in American right-wing circles, where the 88-year-old Hungarian-American philanthropist plays the role of villainous global puppet-master in countless conspiracy theories.
Russia’s Internet Research Agency—the so-called “troll farm, later indicted by Special Counsel Robert Mueller—pushed the same trope on its Facebook and Instagram feeds in the run-up to election day. One meme featured a close-up of Soros against a backdrop of anti-Trump picketers. “No lives matter for those who sponsoring [sic] anti Trump protests,” the caption read. Another imagined Soros confronting the late Senator John McCain. “Hey Johnny, I’m paying you a fortune. I don’t care how much cancer you have, get back to DC and backstab Trump.”
The Soros targeting comes in the wave of what one expert describes as a fresh wave of Fancy Bear attempts against political nonprofits in the U.S. that ran from last December to March or April of this year, using similar tactics to the mass phishing campaign that famously ensnared Hillary Clinton’s campaign chief in 2016.
“It’s a similar type of activity to what hit Podesta,” said Robert Johnston, the former Marine Corp captain who investigated the 2016 DNC breach, and now heads the financial cybersecurity firm Adlumin. “These were against political organizations and NGOs. The FBI has reached out to of bunch of them.”
https://www.thedailybeast.com/russias-election-hackers-are-backand-targeting-george-soros-and-his-open-society-foundations