2024 US Presidential Election Cyber Intrusion: Part 3 - Hostile Nation State Actors

Part 3 of a series that will analyze critical cyber security aspects during the countdown  to the 2024 US Presidential Election, beginning with Covert Influence Operations then Nation State Threat Actors, Hactivism and Cybercrime.


The upcoming US Presidential Election is facing a range of cyber security challenges from nations that oppose the democratic foundation of the Western world.

Based on the ever-evolving nature of this cyber threat landscape, the election period will attract a complex theatre of nation state-level cyber activity involving the deployment of intrusive attack vectors, influence campaigns and hybrid threats combing both methods.

Iran

Based on the highly unstable foreign affairs climate between the US and Iran, several Tehran-aligned threat groups will likely seek to compromise the 2024 US Presidential Election.

Firstly, domains have already started to impersonate US media organisations and think tanks demonstrating overlaps with the malicious infrastructure of Mint Sandstorm - a state-level hacker unit that has demonstrated persistent attacks against Western governments and organisations that deal with Iranian sanctions. These infrastructural similarities relate to naming and registration patterns that are likely designed for credential harvesting attacks .

What should be noted, is that Mint Sandstorm have a track record of interfering with the US political arena - the unit attempted to compromise the 2020 US election by targeting email accounts belonging to US presidential campaign staff . This trend has not changed as throughout the past 6-months, Mint Sandstorm has already launched credential phishing attempts against email accounts of individuals linked with President Joe Biden and former President Donald Trump as well as current and former US government officials, including Vice President and Democratic Party forerunner, Kamala Harris . The disclosure of this intelligence was soon followed up by the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the Director of National Intelligence (ODNI) releasing a joint statement on August 19th, 2024, attributing the recent cyber-attack aimed towards the campaign of former President Donald Trump to hostile Iranian actors . 

Next up, we have UNC2448, an Iranian state-level cyber force that has an extensive history of exploiting zero-day security flaws to compromise Western pollical establishments. Notable to the US Presidential Election is that individual actors operating within this state hacking group have previously been indicted for launching ransomware attacks against US organisations , as well as exploiting the Log4Shell vulnerability (CVE-2021-44228) to compromise a Federal Civilian Executive Branch (FECB) organization in 2022 .

Finally, CISA also disclosed that the Iranian activity group, tracked as Lemon Sandstorm, targeted US federal agencies in 2020 by exploiting VPN vulnerabilities and installing web shells. The group also targeted the 2020 US election by a US city website to report election results, an incident that was reported by the head of US Cyber Command’s Cyber National Mission Force.

More recently, the FBI disclosed  that these state hackers have continued to operate in the interests of the Iranian government by now collaborating with ransomware gangs to target critical infrastructure providers in the US, by forming alliances with high-profile Russian ransomware actors in exchange for a cut of the ransom payments. This collaboration likely reflects the growing strategic cooperation between the Russian Federation and the Iranian regime, as both states continue to be heavily sanctioned by western governments in response to their involvement with international conflicts and nuclear developments.

As a result, we have assessed that Iranian hackers will likely incorporate the finance sector into these operations with the aggressiveness of these attacks likely to be shaped by the outcome of the upcoming US Presidential Election.

For instance, a Republican Party victory in November will cause Iran to come under increased financial strain, with Donald Trump likely to continue to enforce economic sanctions against Tehran relating to the Joint Comprehensive Plan of Action, which is Iran’s nuclear deal that was signed in 2015.

Russia

A combination of disruptive and influence operations will likely be the foundation of Russia’s cyber targeting of the 2024 US Presidential Election which would reflect its “information confrontation doctrine,” combining reconnaissance and disruptive efforts with follow-up psychological operations.

We have observed the implementation of this three-stage protocol in previous campaigns where Moscow state actors have engaged in data theft from target systems, deployed their notorious wiper malware strains, and followed this by advertising the success of their operations by providing evidence of compromise through social media avenues, such as Telegram.

Below is an overview of the Russian cyber units that will likely target the upcoming election with high capability and hostile intent, both directly and indirectly. All of the cyber groups mentioned will likely ramp up the aggressiveness of their efforts as we get closer to November 5th, in retaliation to the US Department of Justice recently indicting individual hackers that were operating under the direction of Unit 29155 of the Russian General Staff Main Intelligence Directorate (also known as its GRU).  

The first threat is Seashell Blizzard , a high impact Russian military intelligence asset that previously attempted to interfere with the US Presidential Election back in 2016 . Linked with Russia’s GRU military intelligence branch, we have assessed that the threat posed by the unit has recently been heightened due to likely collaborated efforts with the recently created “Cyber Army of Russia Reborn” hacktivist persona, allowing for a hybrid approach of disruptive efforts with agile espionage.

Secondly, the Russian State-backed Forret Blizzard, will also likely target the election, with the primary objective of the threat unit to collect intelligence against global targets in support of Russian foreign policy initiatives. This Russian military intelligence activity group has previously engaged in sustained effort to hack into the computer networks of the Democratic Congressional Campaign Committee, the Democratic National Committee, and the presidential campaign, as well as orchestrating a leak campaign as the “DC Leaks” persona back in 2016 .

And finally, Midnight Blizzard , likely has hostile intent to interfere with the 2024 election, with the activity group previously compromising the Democratic National Committee (DNC) ahead of the 2016 US election. The activity group’s campaigns against this year’s US election will likely spillover into the US technology sectors, with the group previously compromising US technology companies and IT service providers to facilitate third party compromises of government and policy organisations. 

China

Chinese offensive efforts leading up to the election will likely involve Beijing state actors using a suite of cyber weapons to scan the country’s networks for security vulnerabilities, to access target systems and extract sensitive dataOperations will involve a combination of espionage and influence campaigns to gather intelligence on the dynamics of US politics and to sow discord amongst US citizens.

The PRC will also likely launch aggressive social media disinformation operations against US businesses and government officials to shape the global information domain in favour of Chinese interests and to portray the US electoral system as chaotic and dysfunctional.

Highlighted below is an overview of the Chinese nation-state hackers that will likely focus on the upcoming US Presidential election:

Firstly, Brass Typhoon poses a significant threat to both the Democratic and Republican parties. This is based on the unit’s track record of conducting widespread vulnerability exploitation that compromised US government entities ahead of the 2020  and 2022  US election proceedings. High ranking US election officials should be particularly vigilant to Brass Typhoon operations as the group is known to create fake profiles to engage in dialogue with high-profile entities to harvest information such as personal or work email addresses. 

Violet Typhoon will also likely be a factor, with the Chinese state group having a track record of engaging in nation-state activity by focussing on former government personnel and think tanks in the US. Notable to the 2024 US Presidential Election is that the hacker unit has demonstrated hostile intent to compromise the US democratic process by conducting phishing operations against US journalists focusing on politics and national security matters. The cyber unit also targeted President Biden’s campaign staff during the 2020 US election process , an event that was followed up in a March 2024 indictment, where the US Department of Justice disclosed that election campaign staff from both the Democratic and Republican parties were targeted throughout this period.

TO BE CONTINUED

Craig Watt is a Threat Intelligence Consultant at Quorum Cyber specializing in strategic and geopolitical intelligence.

Image: gguy44

You Might Also Read: 

2024 US Presidential Election: Hostile Nation State Actors - Part 2:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

 

 

« 2024 US Presidential Election Cyber Intrusion: Part 2 - Covert Influence Operations
A Landmark Ransom Attack On Healthcare »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Malwarebytes

Malwarebytes

Malwarebytes provides artificial intelligence-powered technology that stops cyberattacks before they can compromise computers and endpoints.

Resource Centre for Cyber Forensics (RCCF)

Resource Centre for Cyber Forensics (RCCF)

RCCF is a pioneering institute, pursuing research activities in the area of Cyber Forensics.

Wind River

Wind River

Wind River delivers the technology and expertise that enables the deployment of safe, secure, and reliable intelligent connected systems.

TokenOne

TokenOne

TokenOne is a Cyber Security software company that makes it easy to replace passwords, tokens and other forms of authentication with a more secure solution.

Montimage

Montimage

Montimage develops tools for testing and monitoring networks, applications and services; in particular, for the verification of functional, performance (QoS/QoE) and security aspects.

BwCIRT

BwCIRT

BwCIRT is the Computer Incident Response Team (CIRT) for Botswana and provides an official point of contact for dealing with computer security incidents.

Findcourses.com

Findcourses.com

Findcourses is a dedicated education search engine designed to make it easy for our learners to search and find exactly what they need from our community of trusted training providers.

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange is a new initiative dedicated to advancing effective and innovative public policy in cybersecurity and digital privacy.

Hawk Network Defense

Hawk Network Defense

HAWK.io is the First Fully Automated, Multi-Tenant, Cloud-Based, MDR Service Company.

SuperCom

SuperCom

SuperCom are a global secure solutions integrator and technology provider for governments and other consumers facing organizations around the world.

CAPSLOCK

CAPSLOCK

CAPSLOCK delivers career-changing cyber training to help adults re-skill. Learn online to become a cyber security professional and pay no tuition until you land a high-paying job.

at-yet (@-yet)

at-yet (@-yet)

at-yet are an interdisciplinary team of experts. We are all about achieving results, whatever the situation – an acute incident, risk minimisation, safeguarding or data protection.

Neeve

Neeve

Neeve is an edge cloud platform transforming smart buildings and spaces, making them more secure, smarter, and more sustainable.

Cyber Husky

Cyber Husky

Cyber Husky is an agile technology company that specializes in cloud solutions, cybersecurity, and managed IT services.

Zynap

Zynap

Zynap is an Advanced AI-powered SaaS platform replicating cybercriminal tactics to predict, detect, and neutralize threats before they strike.

Boo Consulting

Boo Consulting

Boo Consulting is a trusted privacy and risk consultancy firm. We are driven to help you find an appropriate solution that will suit your budget and requirements.