Skip to main content

Advertisement

AIScoop

FedScoop

DefenseScoop

CyberScoop

StateScoop

EdScoop

Advertise

Search

Close

Search for:

Search

Open navigation

Topics

Back

AI

Cybercrime

Commentary

Financial

Government

Policy

Privacy

Technology

Threats

Research

Workforce

Special Reports

Events

Podcasts

Videos

Insights

Subscribe to Newsletters

Advertise

Ukraine

Switch Site

AIScoop

FedScoop

DefenseScoop

CyberScoop

StateScoop

EdScoop

Subscribe

Advertisement

Subscribe to our daily newsletter.

Subscribe

Close

Government

Researchers link Macron hack to APT28 with ‘moderate confidence’

"Flashpoint’s hypothesis [is] that the Macron leak was undertaken by Fancy Bear."

By
Patrick Howell O'Neill

May 11, 2017

Emmanuel Macron (French Embassy in the U.S. / Flickr)

This story has been updated.

The cybersecurity firm Flashpoint linked the hacking and leaking of French President Emmanuel Macron’s emails to Fancy Bear, the hacking group also known as APT28.

“Flashpoint’s hypothesis [is] that the Macron leak was undertaken by Fancy Bear based on the contents of the dump itself, as well as the current and historic political environment in which this attack took place,” said Vitali Kremez, research director for Flashpoint. APT28, which has been linked to Russian intelligence agencies, was blamed for hacking Hillary Clinton’s campaign and the Democratic National Committee in 2016. Researchers have recently linked other high-profile phishing attempts to the group.

“Our assessment of the Russian APT28 interference in the recent French elections was based on a multitude of facts to support our findings,” Tom Hoffmann, Flashpoint’s vice president of intelligence, told CyberScoop. “The recent leak of Macron documents fits into a pattern of cyber activity directed against Western government entities that has been traced to Russian threat actors, and specifically to Fancy Bear, over the course of a number of years. This threat group has traditionally undertaken attacks that align with the geopolitical interests of the Russian Federation.”

Advertisement

Hoffmann pointed to a report by Trend Micro showing Russian cyber operations against the Macron campaign, the Macron campaign’s own claims of cyber operations against it, an apparent but unproven attempt to scrub metadata from the leaked data that linked the operation to a Russian company with several government security contracts, the alignment with Russian geopolitical goals and other similarities (including the use of social media bots and disinformation campaigns) to previous Fancy Bear-linked operations. Additionally, Hoffman points to Admiral Mike Rogers’ statement on US communications with France regarding Russian cyber activity,

“Any one of these data points in and of themselves doesn’t point us to APT28 or Russia,” Hoffmann said. “But I think when you look at all these data points together, that’s what led us to make that moderate confidence assessment that it was APT28.”

An April 2017 report from TrendMicro identified numerous cyber-operations involving both phishing and malware traced back to APT28. Part of TrendMicro’s research and subsequent reporting by the cybersecurity firm ThreatConnect identified specific domains belonging to Fancy Bear in order to attack the French campaign.

Moscow’s geopolitical interest in the French election is also crucial for context when evaluating cyberattacks against Macron. Marine Le Pen, the far right-wing nationalist who finished second in the election, made numerous campaign promises that align with stated Russian interests, including ending sanctions against Russia, recognizing Crimea as a part of Russia and withdrawing France from the European Union.

The leaked data also came with telling metadata pointing to edits made by Рошка, Георгий Петрович (Georgy Petrovich Roshka), a name linked to Evrika, a Russian intelligence contractor. The metadata has raised many eyebrows but is hardly definitive because it could easily be forged.

Advertisement

Earlier this week, Adm. Michael Rogers, who leads both the U.S. Cyber Command and the NSA, testified that the NSA tracked Russian hackers working against French political targets and then alerted French authorities prior to the “massive and coordinated hack” against the campaign of President-elect Emmanuel Macron. Reports of Russian cyber-operations against Macron have been public since at least January. Macron won the election with around two-thirds of the vote but upcoming major elections around Europe carry the specter of further hacking and interference.

“If this is APT28, then they have not abandoned this tool,” John Hultquist, a senior analyst at the cybersecurity firm FireEye, told CyberScoop. “We can anticipate they’ll continue to use it until the consequences for these actions are greater.”

What comes next will help define the future of Europe. The United Kingdom’s general election on June 8, French legislative election are on June 11 and 18 and German federal elections take place on Sept. 24.

Correction: A review by cybersecurity firm Area 1 Security of a previous version of this story revealed a technical error that had led to inaccurate analysis by Flashpoint. Flashpoint acknowledged and apologized for the mistake but stands by its overall assessment of “moderate confidence that the group is likely linked to Russia’s Main Intelligence Directorate (GRU)” and, furthermore, with APT28.

The previous version of the story included a screenshot pointing to phishing domains said to be linked to Fancy Bear and used against Macron. The screenshot Flashpoint offered showed the tool Autopsy with the keyword search “mail-en-macron.fr” — suggesting that a malicious domain was present. In fact, a bug in Autopsy inserted characters and led to a false conclusion about the links in the leaked data.

Advertisement

CyberScoop has removed the screenshot of the bugged Autopsy tool to avoid further confusion.

Written by Patrick Howell O'Neill

Patrick Howell O’Neill is a cybersecurity reporter for CyberScoop based in San Francisco.

In This Story

Russia

National Security Agency (NSA)

Fancy Bear

APT28

Vladimir Putin

Russian hackers

France

Emmanuel Macron

Marine Le Pen

Adm. Mike Rogers

Share

Facebook

LinkedIn

Twitter

Copy Link

Advertisement

Advertisement

More Like This

Forget AI: Physical threats are biggest risk facing the 2024 election

By

Derek B. Johnson

Top spy official releases principles on intel agency use of info bought from data brokers

By

Tim Starks

House panel leaders call on Microsoft president to testify over security shortcomings

By

Tim Starks

Advertisement

Top Stories

BreachForums, a key English-language cybercrime forum, seized by the FBI

By

AJ Vicens

AI companies promise to protect our elections. Will they live up to their pledges?

By

Derek B. Johnson

Inside Poland’s groundbreaking effort to reckon with spyware abuses

By

Tim Starks

Advertisement

More Scoops

Ukrainian security forces stand guard with shell-damaged buildings in the background in the northwestern Kyiv suburb of Borodyanka, Ukraine, on April 21, 2022. (Photo by Scott Peterson/Getty Images)

Multiple government hacking groups stay busy targeting Ukraine and the region, Google researchers say

Multiple ongoing hacking efforts are either connected to or using the Russian military assault to target a wide range of entities.

People stand with their luggage as they wait to be relocated from the temporary shelter for refugees in a former shopping center between the Ukrainian border and the Polish city of Przemysl, in Poland, on March 8, 2022. (Photo by LOUISA GOULIAMAKI/AFP via Getty Images)

Against backdrop of Russian-Ukraine war, researchers witness flurry of nation-aligned hacking

Fancy Bear

When Fancy Bear isn’t so Fancy: APT group’s ‘crude’ methods continue to work

By

Sean Lyngaas

Norwegian police implicate Fancy Bear in parliament hack, describe ‘brute forcing’ of email accounts

By

Sean Lyngaas

State-backed hackers targeted Biden and Trump campaign associates, Microsoft says

By

Sean Lyngaas

NSA, FBI publicize hacking tool linked to Russian military intelligence

By

Shannon Vavra

Pentagon again deploying cyber personnel abroad to gather intel for 2020 elections

By

Shannon Vavra

Latest Podcasts

How Troy Hunt knows if you’ve been hacked and Washington tries to understand AI

Why pig butchering is the worst kind of online scam

How the FBI fights ransomware

Stefan Soesanto on Ukrainian hack and leak ops; cyberattack in Georgia

Government

ONCD report: ‘Fundamental transformation’ in cyber, tech drove 2023 risks

The missed opportunities in White House’s critical infrastructure directive

CISA's incident reporting requirements go too far, trade groups and lawmakers say

US spy agencies to share intelligence on critical infrastructure in policy revamp

Technology

Democratic operative behind Biden AI robocall says lawsuit won’t ‘get anywhere’

House hurtles toward showdown over expiring surveillance tools

Civil society groups press platforms to step up election integrity work

FBI seeks to balance risks, rewards of artificial intelligence

Threats

Ransomware used in attack that disrupted US hospitals

Major health care system hobbled by ‘cyber incident’

Boeing confirms attempted $200 million ransomware extortion attempt

US, UK authorities unmask Russian national as LockBit administrator

Geopolitics

How an Iranian-linked influence campaign pivoted after Oct. 7 attack on Israel

State Department wants ‘digital solidarity’ at center of tech diplomacy

Iranian nationals charged with hacking U.S. companies, Treasury and State departments

Mandiant: Notorious Russian hacking unit linked to breach of Texas water facility

Advertisement

About Us

FedScoop

DefenseScoop

StateScoop

EdScoop

CyberScoop

AIScoop

Newsletters

Advertise with us

Ad specs

(202) 887-8001

[email-masked]

FB

TW

LinkedIn

IG

Close Ad

Continue to CyberScoop