Microsoft points finger at Fancy Bear for Euro-election hacks

Redmond says recent attacks on European democratic organisations originated from the "Strontium" group

A drawing of an angry Russian bear

Microsoft has pointed the finger of blame upon a group of hackers associated with Russian intelligence for targetting civil society groups ahead of European elections in May.

Redmond's corporate vice president of customer security and trust Tom Burt said he was confident a group called "Strontium" was responsible for a string of recent cyber attacks that targeted more than 100 email accounts at think tanks and non-governmental organisations that work on issues including election security, nuclear policy and foreign relations.

Disinformation attacks and elections rigging have become a rising global problem over the last few years, with many laying the blame at Russia's door. This was most notable during the 2016 US presidential elections and European leaders have recently warned that attacks will continue across Europe in 2019.

Advertisement - Article continues below

"We've seen recent activity targeting democratic institutions in Europe as part of the work our Threat Intelligence Center (MSTIC) and Digital Crimes Unit carry out every day to protect all of our customers," Burt said.

"These attacks are not limited to campaigns themselves but often extend to think tanks and non-profit organizations working on topics related to democracy, electoral integrity, and public policy and that are often in contact with government officials."

Advertisement
Advertisement - Article continues below

As an example, Burt explained that Microsoft has recently detected attacks targeting employees of the German Council on Foreign Relations and European offices of The Aspen Institute and The German Marshall Fund.

He said the attacks against these organisations, which it has disclosed with their permission, targeted 104 accounts belonging to organisation employees located in Belgium, France, Germany, Poland, Romania, and Serbia.

Microsoft's MSTIC division will continue to investigate the sources of the attacks, but it's confident that many of them originated from "Strontium" which is a known alias of Fancy Bear, the infamous Russian hacker group.

Advertisement - Article continues below

"The attacks occurred between September and December 2018," Burt said. "We quickly notified each of these organisations when we discovered they were targeted so they could take steps to secure their systems, and we took a variety of technical measures to protect customers from these attacks."

Burt said that consistent with campaigns against similar US-based institutions, attackers in most cases create malicious URLs and spoofed email addresses that look legitimate. Using spearphishing campaigns to gain access to employee credentials and deliver malware.

"The attacks we've seen recently, coupled with others we discussed last year, suggest an ongoing effort to target democratic organizations. They validate the warnings from European leaders about the threat level we should expect to see in Europe this year."

Advertisement

Recommended

Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020
Visit/security/internet-security/355228/mozilla-fixes-two-firefox-zero-days-being-actively-exploited
internet security

Mozilla fixes two Firefox zero-days being actively exploited

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020