Reuters
Russian hackers linked to the 2016 election cyberattacks on the Democratic Party are widening their targeting for the coming midterms to include the U.S. Senate and well-connected conservative groups, according to new research from Microsoft Corp.
Microsoft MSFT, -0.66% last week took down six internet domains registered by a Russian hacking group that sought to mimic legitimate websites. The domains appeared to mark the early stages of spear-phishing attacks intended to compromise political operatives working for or around the targeted organizations.
One of the domains mimicked the International Republican Institute, Microsoft said. The IRI is a Republican-leaning think tank that has counted Sens. Lindsey Graham, John McCain and Marco Rubio—all of whom advocate tough policies against Russia—among its board members. Other targets include the Hudson Institute, which is a Washington, D.C.-based conservative think tank, as well as the U.S. Senate, Microsoft said.
Microsoft said it had no evidence any of the spoofed internet domains were used in any successful cyberattacks before the company seized control of them.
“There can’t be an even peripherally involved office in politics in Washington that does not routinely get emails ending in .ru with weird attachments in them.”
The domains were registered by a hacking group associated with Moscow’s military intelligence agency, the GRU. In the past, the hackers, commonly referred to as Fancy Bear or Strontium, have used phishing emails to direct targets to fake websites designed to resemble legitimate ones where they steal login credentials, according to security researchers.
An expanded version of this report appears on WSJ.com
Popular on WSJ.com:
Luxury Apartment Sales Plummet in New York City
Military Faces a Sweeping Turnover Among Upper Commanders
Want news about Europe delivered to your inbox? Subscribe to MarketWatch's free Europe Daily newsletter. Sign up here.