While refusing to disclose their names for privacy reasons, Tom Burt, Microsoft’s vice president for customer security, told the Aspen Security Forum that the three candidates “were all people who, because of their positions, might have been interesting targets from an espionage standpoint, as well as an election disruption standpoint.”

Burt said that the hackers targeted the candidates’ staffers with the kind of phishing tactics used to inveigle their way into the Democratic National Committee servers in 2016: They set up a fake Microsoft domain and attempted to direct staffers towards it. Mr Burt told the Aspen Security Forum attendees: "Earlier this year, we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks and we saw metadata that suggested those phishing attacks were being directed at three candidates who were all standing for election in the mid-term elections." Microsoft also did not reveal the names of the affected candidates nor their political party affiliations, but Burt noted that “because of their positions, [the candidates] might have been interesting targets from an espionage standpoint, as well as an election disruption standpoint.” The company traced the hacks back to the Russian group Strontium, which is widely believed to be closely linked to Russia’s GRU military intelligence agency.
Microsoft reports that at least three United States congressional candidates have been targeted by hackers in the lead-up to the 2018 midterm elections.