Microsoft removes risk to election
Microsoft and a team of companies and law enforcement groups have disabled — at least temporarily — one of the world’s largest hacking operations, an effort run by Russian- speaking cybercriminals that officials feared could disrupt the presidential election in three weeks.
But as soon as Microsoft began dismantling the operations last week, seeking to cripple a network of infected computers known as TrickBot that has been used to paralyze computer systems with ransomware attacks, it discovered that someone else was trying to do the same thing.
In a separate but parallel effort — which was apparently not coordinated with Microsoft — U. S. Cyber Command, the military cousin to the National Security Agency, had already started hacking Trick
Bot’s command and control servers around the world late last month, according to two government officials.
The one- two punch painted a picture of the accelerating cyberconflict underway in the final weeks before the elections. Cyber Command, following a model it created in the 2018 midterm elections, kicked off a series of covert preemptive strikes on the Russianspeaking hackers it believes could aid President Vladimir Putin in disrupting the casting, counting and certifying of ballots this November. Meanwhile, Microsoft, Symantec and other American companies are doing the same.
TrickBot is their biggest target yet. A vast network of infected computers, known as a botnet, TrickBot has been used for everything from stealing people’s online banking credentials to attacking towns, cities and hospitals with ransomware, malware that locks up victims’ computers until they pay a ransom, often in Bitcoin. So far, TrickBot has not been directed at voting infrastructure, officials say. But it would be well suited to turn against the offices of the secretaries of state who certify tallies, vulnerable voter registration systems or electronic poll books, the records that allow people to vote.
“Just imagine that four to five precincts were hit with ransomware on Election Day,” said Tom Burt, the Microsoft executive overseeing the team that has been dismantling TrickBot.
“Talk about throwing kerosene on this unbelievable discussion of our elections and about whether the results are valid or not,” Burt said. “It would be a huge story. It would churn on forever. And it would be a huge win for Russia. They would be toasting with vodka well into the next year.”
“That is a risk I want to take out,” he said.
Burt said he did not know for sure where the TrickBot operators were based beyond Eastern Europe. But they are Russianspeaking and have developed their tools into a sophisticated, profitable operation. They not only infect computers, but also catalog lists of infected computers and sell access to valuable systems to other cybercriminals looking to commit banking fraud or lock them up with ransomware.
The list of victims has expanded to include cities in Florida, courts and school districts in Georgia, The Los Angeles Times, the city of New Orleans and state agencies in Louisiana, and, in recent weeks, one of the largest medical cyberattacks in U. S. history after ransomware delivered through TrickBot hijacked more than 400 hospitals run by Universal Health Services.
What connection, if any, TrickBot’s operators share with the Kremlin remains an open question. But the acceleration of ransomware attacks on U. S. municipalities and government agencies has led U. S. officials and executives at Microsoft to fear that ransomware attacks will be used to lock up election systems in November, either on direct orders from a state eager to undermine American democracy or by cybercriminals who figure the urgency around the election would increase pressure on victims to pay.
According to Intel 471, a security firm, there were two attacks on the TrickBot infrastructure before Microsoft received court authorization a week ago to begin its operations. The blog Krebs on Security reported the attacks.
Those two attacks, on Sept. 22 and Oct. 1, apparently conducted by Cyber Command, infiltrated TrickBot’s command and control servers and temporarily cut off cybercriminals’ access to thousands of infected PCs that have been used as a primary conduit for global ransomware attacks.