Image copyright AFP Image caption The US mid-term elections will take place on 6 November

At least three congressional candidates have been targeted by hackers ahead of the US mid-term elections, according to Microsoft.

Tom Burt, an executive at the firm, made the revelation during a security conference panel in Colorado.

The three candidates appear to have been targeted by phishing attacks, he told the audience.

One cybersecurity expert said the hacking was probably an attempt to "undermine the democratic process".

US voters will go to the polls on 6 November to elect a swathe of new members of Congress, senators and state governors.

Phishing attacks

The tech giant discovered the apparent foul play after checking fake Microsoft web domains that had been associated with espionage in 2016.

A group exploiting the domains is known by many as "Fancy bear" but has been dubbed "Strontium" by Microsoft.

Some cybersecurity firms, including SecureWorks and Mandiant, believe the hackers are linked to Russian intelligence.

Russia has consistently denied allegations of hacking.

Mr Burt told the Aspen Security Forum attendees: "Earlier this year, we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks and we saw metadata that suggested those phishing attacks were being directed at three candidates who were all standing for election in the mid-term elections."

In other words, the hackers tried to trick the candidates into visiting a bogus Microsoft web page.

Media playback is unsupported on your device Media caption The US Director of National Intelligence reacts to Putin visit news: 'That's going to be special...'

Mr Burt did not name the affected candidates but said they were all potentially "interesting targets from an espionage standpoint".

He added that the hackers were not successful in accessing the three candidates and that the fake Microsoft domain had been taken down.

The hackers might have been trying to gain access to the candidates' personal messages or emails, for example, said cybersecurity expert Prof Alan Woodward at the University of Surrey.

"If you can grab emails... you can start making people look bad," he said.

"I think the primary motive is to undermine the democratic process so it doesn't matter which candidate they manage to subvert."

In comments to the press during his visit to Helsinki earlier in the week, President Trump said "no" when asked if he thought that Russia was continuing to interfere in American elections.

However, his press secretary Sarah Huckabee Sanders claimed that the president actually had responded "no" to a query of whether he would be taking further questions.

Last week, the US Director of National Intelligence said Russian attempts at hacking US targets remained "persistent... regardless of whether it is election time or not".

Prof Woodward told the BBC: "Every single intelligence agency, including the British ones, have said it's ongoing, it's an ongoing onslaught and the finger seems to point at Russia."</s>Less than a week after the United States government charged 12 Russian officers for hacking in the 2016 presidential election, Microsoft is accusing the same Russian intelligence agency of using a phishing scheme to hack at least three additional candidates in the 2018 midterm election. Microsoft vice president for customer security and trust Tom Burt revealed the company’s findings at the Aspen Security Forum’s Defending Democratic Institutions: Election 2018 and Beyond panel.

“Earlier this year we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks,” Burt said. “We saw metadata that suggested those phishing attacks were being directed at three candidates.” Details of the attack were not revealed, but phishing attacks usually involve hackers sending an email with a web address containing a malicious link that’s designed to install malware when it is activated. As part of its work with the United States government, Microsoft was able to seize the domain before it could inflict damage.

Microsoft also did not reveal the names of the affected candidates nor their political party affiliations, but Burt noted that “because of their positions, [the candidates] might have been interesting targets from an espionage standpoint, as well as an election disruption standpoint.” The company traced the hacks back to the Russian group Strontium, which is widely believed to be closely linked to Russia’s GRU military intelligence agency.

Burt’s announcement comes less than a week after U.S. Special Counsel Robert Mueller indicted 12 members of the GRU for their involvement in hacking the Democratic National Committee in 2016. Similar to the discovery of Russian-linked hacking on the 2018 elections, Microsoft’s security team found that spoofed domains were used in the 2016 election hacks. Though hacking politicians has been part of spy organizations, leaking the information is seen as a violation of the practice, Buzzfeed News reported. “A hacker group from a second Russian intelligence agency had penetrated the DNC as early as 2015, but didn’t spread that information, and has avoided the kind of international condemnation aimed at the GRU,” the site noted.

Despite continued warnings by U.S. intelligence officials, including FBI Director Christopher Wray and National Intelligence Director Dan Coats, that election hacking will be a likelihood in the 2018 elections and beyond, the Republican-controlled House voted to eliminate new funding for states to strengthen election security, The New York Times reported. In addition to U.S. hacks, the GRU is also believed to have targeted the campaign of French president Emmanuel Macron.</s>July 20 (UPI) -- Hackers have already targeted candidates in this year's U.S. midterm elections, a Microsoft executive said.

Tom Burt, Microsoft's vice president for customer security and trust, spoke at the Aspen Security Forum on Thursday. Responding to a question, he said hackers responsible for targeting political organizations in the 2016 U.S. presidential election have already attempted to target staffers of at least three unidentified candidates.

"Earlier this year, we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks and we saw metadata that suggested those phishing attacks were being directed at three candidates who are standing for election in the midterm elections," Burt said. "We can't disclose [identities] because we maintain our customer privacy, but I can tell you that they were all people who, because of their positions, might have been interesting targets from an espionage standpoint as well as an election disruption standpoint. We took down that domain, and working with the government we were able to avoid anybody being infected by that particular attack."

The phishing approach, in which candidates are tricked into visiting a fake web page and give up sensitive information, was used by Russian hackers in 2016. Some cybersecurity firms believe the new attacks are linked to Russian intelligence, the BBC reported on Friday.

The hacking team is known to Microsoft engineers as Strontium, but it is also known as APT28, Fancy Bear and Pawn Storm, Newsweek reported. Under those names, the group previously worked with the Russian military intelligence agency GRU.

Burt added that the level of activity is currently less than in 2016, but cautioned it "doesn't mean we are not going to see it. There's a lot of time left before the election."

One-third of the 100-member U.S. Senate, all 435 seats in the House of Representatives and numerous state and local offices are at stake in the Nov. 6 election.</s>Microsoft VP says the same tactic was used by hackers in 2016 election

(Bloomberg) — Microsoft Corp. said it identified and stopped attempts to launch cyberattacks on three 2018 congressional candidates using a phony version of its website.

The targets, who it didn’t identify, were “all people who because of their positions might have been interesting from an espionage standpoint, as well as an election disruption standpoint,” Tom Burt, Microsoft’s corporate vice president for customer security and trust, said at the Aspen Security Forum in Colorado on Thursday.

Burt said the attackers tried to use a phony Microsoft web page to make “phishing” attacks on the candidates. Working with the government, Burt said the company removed the internet domain and prevented the attacks from succeeding.

He said that Microsoft saw the same tactic attempted during the 2016 Democratic Convention in Philadelphia, at which the company provided protection.

A Facebook Inc. executive on the same panel at the Aspen conference said that in April, the company removed a few hundred pages on the service controlled by the St. Petersburg-based Internet Research Agency, which has been indicted by Special Counsel Robert Mueller for an alleged social media campaign aimed at interfering in the 2016 U.S. election.

Monika Bickert, Facebook’s head of product policy and counterterrorism, said the accounts were spreading Russian language advertisements in Russian-speaking countries.</s>Russian hackers are back targeting American democracy. This time it’s the midterm elections. And three congressmen are the targets.

Tom Burt, corporate vice president for customer security and trust at Microsoft, told delegates at an Aspen Security Forum in Colorado Thursday that Russian hackers had registered a fake Microsoft website earlier this year. It was a phishing website and unspecified “metadata” indicated it was set up to target three separate candidates for the 2018 midterms. Burt didn’t have many more specifics, though he said the phishing page was targeted at those candidates’ staff.

Phishing pages are sites that look legitimate but aren’t. They typically either trick victims into handing over passwords or attempt to download malware on their computer. In the attacks on the Clinton campaign, for instance, fake Gmail messages were sent to the candidate’s staff, asking them to change their passwords. The emails took targets to a fake Google page controlled by the hackers.

It was unclear whether the midterm hackers were the same as those believed by American intelligence agencies to have broken into the Democratic National Committee (DNC) and the Hillary Clinton campaign in 2016. Burt did, however, previously refer to a hacker crew his company calls Strontium (more commonly referred to as Fancy Bear), which Microsoft had attempted to disrupt.

“They [the congressmen] were all people who, because of their positions, might have been interesting targets from an espionage standpoint as well as an election disruption standpoint,” he said. “We don’t know the answer.”

Burt said the phishing website was taken down and Microsoft had worked with the government to “avoid anyone being infected by that particular attack.” “They did not get in,” he said. “They tried, they were not successful.”

Despite concern over the attacks on the unnamed candidates, Burt said that in investigating with partners like Facebook, it was apparent Russian activity was not at the same level as in the lead up to the 2016 presidential election.

“That doesn’t mean we’re not going to see it. There’s a lot more time left before the election,” he added.

Microsoft declined to provide more information on the attacks.

The Microsoft exec’s claims came a week after President Trump went back and forth on whether he believed Putin had ordered cyberattacks on the Democrat bodies. During a press conference with the Russian president, Trump said he had “great confidence” in his intelligence advisors but noted “President Putin was extremely strong and powerful in his denial today.”

Trump later backtracked, but then claimed Russia was no longer targeting the U.S., contradicting Dan Coats, the director of national intelligence (and now Microsoft). Just yesterday, the White House said it was going to invite Putin to America for a visit this fall.</s>Three congressional candidates in the United States standing for the 2018 mid-term elections had been the target of cyber attacks reportedly orchestrated by threat actors from Russia.

Microsoft confirmed that it intercepted the attacks which used a fraudulent version of its website as a front to spy on the candidates early this year. The company, however, refused to drop the names of the candidates for the sake of their privacy and security.

Tom Burt, the corporate vice president for customer security and trust at Microsoft, revealed at the Aspen Security Forum in Colorado on Thursday that the attackers used the fake Microsoft domain "as the landing page for phishing attacks" in order to insinuate themselves into the campaigns of the quarries. Burt added that the three congressional hopefuls were singled out possibly because of their position which makes for a great target from an espionage and election disruption standpoints.

According to Burt, the domain was already taken down. They are now working with the government to give the attackers a wide berth and avoid potential targets from getting attacked.

Despite the threat, Burt had stressed that they are not seeing a considerable success from Russia's electoral interference this time as compared to the 2016 elections.

"I would say that the consensus of the threat intelligence community right now is [that] were not seeing the same level of activity by the Russian activity groups leading into the mid-year elections that we could see when looking back on the 2016 elections."

Nonetheless, the 2018 mid-year elections are more than three months away so Burt is calling on all concerned agencies and the private sector to be vigilant.

It's not the first time that Microsoft thwarted the same method of attack as during the 2016 Democratic Convention in Philadelphia, it busted Russia-based hacking group APT28, stamping on over 90 internet domains from them. The company suspected that APT28 may be run by Russia's military intelligence agency.</s>Microsoft recently stopped an effort to hack three US candidates up for election this year.

The attack relied on a spoofed Microsoft domain to target the candidates' campaign, company vice president Tom Burt said during a panel session at the Aspen Security Forum on Thursday.

"Earlier this year we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks," he said. "We saw metadata that suggested those phishing attacks were being directed at three candidates."

Burt didn't go into details, but phishing attacks usually involve hackers sending an email to the recipients, with the goal of tricking them into visiting a webpage designed to secretly install malware or fool someone into giving up their passwords.

Fortunately, in this case, Microsoft seized the domain before the attack could infect any computer. Although Burt declined to name the candidates targeted, he said: "They were all people, because of their positions, might have been interesting targets from an espionage standpoint as well as an election disruption standpoint."

Burt raised the issue when talking about Microsoft's efforts to stop Russian state-sponsored election meddling. During the 2016 presidential election, the company's security teams noticed what many believe to be a Russian hacking group target Democrats using spoofed Microsoft domain names, Burt said.

Microsoft's reveal comes as US officials warn that Russian actors will try to interfere with the 2018 mid-term elections and the country's critical infrastructure.

So far, Burt said Russian efforts to meddle with the 2018 mid-terms, haven't matched the level of activity the company saw during the 2016 election, which involved attacks on think tanks and academia and using social networking services to research potential targets.

"It doesn't mean weren't not going to see it," he added. "There's a lot of time left until the election."</s>Attackers attempted to use a phony version of Microsoft's website to make phishing attacks on three 2018 congressional candidates.

The company found and stopped the cyberattack attempts, said Tom Burt, corporate vice president for customer security and trust at Microsoft, at the Aspen Security Forum in Colorado on Thursday. He declined to name the candidates, but said they were "all people who because of their positions might have been interesting from an espionage standpoint, as well as an election disruption standpoint."

Microsoft worked with the government to remove the domain and stop the attacks.

Attackers also tried to use a phony Microsoft site during the 2016 Democratic Convention in Philadelphia, Burt said.

In April, Microsoft launched its Defending Democracy Program, which aims to protect campaigns from hacking and increase online political ad transparency, among other things.</s>Six days after the US charged 12 Russian hackers with stealing and leaking DNC emails, a Microsoft executive says the same agency is targeting the midterm election.

A man walks past the building of the headquarters of the Russian General Staff's Main Intelligence Department (GRU) in Moscow on December 30, 2016.

The same Russian intelligence agency charged with hacking Democrats’ emails in 2016 has targeted at least three candidates running for election in 2018, a Microsoft executive said.



Speaking on a panel at the Aspen Security Forum on Thursday, Tom Burt, the company’s Vice President for Customer Security and Trust, said that his team had discovered a spear-phishing campaign targeting three candidates running for election in 2018. Analysts traced them to a group Microsoft has nicknamed Strontium, which is closely tracked by every major threat intelligence company and is widely accepted to be run by the GRU, Russia’s military intelligence agency.

Burt declined to name the candidates during the event, citing privacy concerns, and didn’t say which party they belonged to, but implied they were candidates of note and running for reelection.

“They were all people who, because of their positions, might have been interesting targets from an espionage standpoint, as well as an election disruption standpoint,” Burt said.

On Friday, Special Counsel Robert Mueller’s office announced charges against 12 GRU officers it accused of conducting a months-long campaign to hack Democrats in 2016, particularly those working to elect Hillary Clinton, and leaking what it found in an effort to hurt her candidacy. Those same hackers attacked the Democratic Congressional Campaign Committee that year, using the fictitious persona Guccifer 2.0 to release assessments of candidates in various House races.



The GRU’s tactics have rankled western intelligence agencies, which view hacking hacking politicians as standard spycraft, but leaking that information to be a major violation of norms. A hacker group from a second Russian intelligence agency had penetrated the DNC as early as 2015, but didn’t spread that information, and has avoided the kind of international condemnation aimed at the GRU.

GRU hackers are believed to be behind a number of global hack-and-leak operations aimed at entities adversarial to Russia, including French President Emmanuel Macron’s 2017 campaign and the World-Anti Doping Agency, whose reports led to Russia’s ban from the 2018 Olympics over its massive doping program.

In recent weeks, officials from the Department of Homeland Security have insisted that though they’re watchful of potential Russian hacking, they’ve seen no sustained campaign against election systems.

DHS has considered election equipment and voter registration databases critical infrastructure, and thus under its umbrella of protection, since the beginning of 2017. But while the tech industry has provided campaigns with some free tools, there is no such overarching body or regulation specifically protecting them. A number of Democratic campaigns told BuzzFeed News in March that they had received no cybersecurity advice in 2018.

When asked by BuzzFeed News, Microsoft also declined to address which parties it had seen targeted. A representative from the Republican National Committee didn’t immediately respond to a request for comment.

A representative from the Democratic National Committee, Xochitl Hinojosa, didn't address whether any Democrats had been targeted, but told BuzzFeed News that “We saw the Russians attack our democracy in 2016 and we know they're a threat in 2018, 2020 and beyond. Unfortunately, the President refuses to acknowledge this serious threat to our country, and House Republicans are refusing to increase funding for election security.”</s>A Microsoft executive today swiftly contradicted Donald Trump’s claim that Russia is not trying to disrupt the 2018 midterms: The company has already worked with the US government to foil Russian hacking attempts on three candidates.

While refusing to disclose their names for privacy reasons, Tom Burt, Microsoft’s vice president for customer security, told the Aspen Security Forum that the three candidates “were all people who, because of their positions, might have been interesting targets from an espionage standpoint, as well as an election disruption standpoint.”

Burt said that the hackers targeted the candidates’ staffers with the kind of phishing tactics used to inveigle their way into the Democratic National Committee servers in 2016: They set up a fake Microsoft domain and attempted to direct staffers towards it. The government and Microsoft “were able to avoid anyone being infected by that particular attack,” he said.

When asked yesterday if he believed Russia was interfering in the US midterms, Trump said: “No.” This contradicted his own intelligence chief Dan Coats’s statement days earlier: “Today, the digital infrastructure that serves this country is literally under attack.”

White House press secretary Sarah Huckabee Sanders later claimed Trump had been misunderstood, insisting that he had meant “no” to further questions from reporters. “We believe that the threat still exists,” she said, according to the New York Times (paywall). “Which is why we are taking steps to prevent it.”

Burt said that so far Russian hackers have been less active than in 2016, during the presidential race. “The consensus of the threat intelligence community right now is that we’re not seeing the same level of activity by the Russian activity groups,” he said. “We don’t see the activity of them trying to infiltrate think tanks and academia and in social networks to do the research that they do to build the phishing attacks.”

He warned, however: “That doesn’t mean we’re not going to see it, there’s a lot of time left before the election.”
Microsoft reports that at least three United States congressional candidates have been targeted by hackers in the lead-up to the 2018 midterm elections.