E-mails phished from Russian critic were “tainted” before being leaked
Campaign targeting more than 200 people also spread disinformation, report says.
E-mails stolen in a phishing attack on a prominent critic of Russian President Vladimir Putin were manipulated before being published on the Internet. That's according to a report published Thursday, which also asserts that the e-mails were manipulated in order to discredit a steady stream of unfavorable articles.
The phishing attack on journalist David Satter's Gmail account was strikingly similar to the one that hit Hillary Clinton presidential campaign chairman John Podesta last year. The attack on Satter looked almost identical to the security warnings Google sends when attackers obtain a subscriber's password. Code embedded inside led Satter to a credential-harvesting site that was disguised to look like Google's password-reset page. With that, the site automatically downloaded all of Satter's private correspondence.
Thursday's report from the University of Toronto's Citizen Lab stopped short of saying Russia's government was behind the phishing attack and subsequent manipulation of Satter's e-mail. US intelligence officials, however, have determined that Russia was behind the attacks on Podesta and other Democratic officials. Thursday's report also said the same attack on Satter targeted 218 other individuals, including a former Russian Prime Minister, members of cabinets from Europe and Eurasia, ambassadors, high-ranking military officers, and CEOs of energy companies.
Shortly after the report was published, CNN investigative reporter Michael Weiss said on Twitter that attackers used Satter's compromised Gmail account in an attempt to phish him, too. The attack was foiled when Weiss sent a response asking Satter to call and confirm it was safe to open an attached file.
In Thursday's report, Citizen Lab researchers wrote:
Quote:
The targets we found are connected to, or have access to, information concerning issues in which the Russian government has a demonstrated interest. These issues range from investigations of individuals close to the Russian president, to the Ukraine, NATO, foreign think-tanks working on Russia and the Crimea, grantmakers supporting human rights and free expression in Russia, and the energy sector in the Caucasus.
Considering this primary Russian focus, as well as the technical evidence pointing to overlaps and stylistic similarities with groups attributed to the Russian government, we believe there is strong circumstantial—but not conclusive—evidence for Russian-government sponsorship of the phishing campaign and the tainted leaks.
Some of the documents obtained in the phishing attack on Satter were published by CyberBerkut, a self-described pro-Russian group. One e-mail was heavily edited to make Satter appear to be paying Russian reporters and activists to write stories critical of the Russian government. The edited e-mail gave the impression the articles were part of a large and non-existent project to pay for articles by a range of authors, which would subsequently be published by a range of media outlets.
The Citizen Lab report came the same day The Wall Street Journal reported that Guccifer 2.0, the public persona who last year published large amounts of e-mails stolen from Democratic officials, privately sent Democratic voter-turnout analyses to a Republican political operative in Florida. The revelation shows how Guccifer 2.0's already considerable influence extended to "exposing Democrats' get-out-the vote strategies in swing states," the WSJ reported. While Guccifer 2.0 has long claimed to be a Romanian activist, US intelligence officials have said they believe the figure works on behalf of the Russian military.
