‘Grizzly Steppe’: how US says Russia hacked the elections

WASHINGTON, Dec 30, (AFP): Russian intelligence agencies over the last two years blanketed Democratic Party targets with malicious emails and have likely continued such efforts after November’s elections, a US federal law enforcement report showed Thursday.

The report’s release coincided with an array of measures unveiled by Washington as retribution for what American officials have described as Moscow’s malicious efforts to tip the vote in favor of President-elect Donald Trump by stealing embarrassing information from Democratic Party operations and senior party members before releasing it to the news media.

The report, produced jointly by the Federal Bureau of Investigation and Department of Homeland Security, traces the routes allegedly taken by hackers to infiltrate party operations, using targeted campaigns of “spearphishing,” or fraudulent emails designed to cause the recipients to reveal passwords and other information, and then stealing large volumes of email.

US officials refer to the Russian hacking efforts collectively as “Grizzly Steppe,” it said.

The report corroborated or matched much of what had already been revealed by news media, which pointed to broad-based hacking by outfits such as APT 28 for “advanced persistent threat” tied to the Russian military intelligence body known as GRU, and APT 29, which may be associated with the FSB, or Russian federal security service.

“This activity by Russian intelligence services is part of a decadelong campaign of cyber-enabled operations directed at the US government and its citizens,” DHS and FBI said in a joint statement with the Office of the Director of National Intelligence, which oversees the sprawling US intelligence community.

US intelligence officials in October formally accused Russia of responsibility for the hacking but have since reportedly been at pains to provide evidence without compromising their own intelligence collection.

The report contained technical specifications and IP addresses that the authors said network administrators could use to identify malicious activity as well as a set of recommendations for hardening networks against attack.

According to the report, in mid2015 APT 29 used legitimate internet domains from US educational institutions and other organizations to host malware and send spearphishing emails to more than 1,000 accounts, including some belonging to US officials, successfully stealing email in bulk from several accounts.

In the spring of 2016, APT 28 also attacked, tricking victims into changing their emails on a fake website hosted by APT 28.