
by Nathalie Bertrand — A hacking group linked by cybersecurity experts to Russia’s
military intelligence apparatus has begun taking aim at France’s
centrist presidential candidate, Emmanuel Macron, the
cybersecurity firm Trend Micro said in a report published on
Tuesday. On March 15, the group — known as Fancy Bear, Pawn Storm, Sednit,
APT28, Sofacy, or STRONTIUM — began registering domain names
like “onedrive-en-marche.fr” and “mail-en-marche.fr” in an
attempt to trick members of Macron’s campaign team into clicking
on links that looked affiliated with his political party, En
Marche.
“A huge revelation in this Trend Micro report is
that Fancy Bear has significantly upped the
sophistication of its cyber attacks,” said Greg Martin, the
CEO of cybersecurity firm JASK. “They’re taking advantage of
vulnerabilities in cloud-based email services like Gmail to trick
people into downloading fake applications, and compromising
their inboxes without even having to steal
a password.” Martin said that when targeted by this kind of attack,
known as “OAuth phishing,” the victim can’t just
change their password to regain access to their account. “It’s a new style of attack is very deadly and
unprecedented,” he said. “It’s the first time we have seen
this in the wild.”
A more primitive version of that phishing
technique was on full display during the US presidential
election. Emails stolen by Fancy Bear from the Democratic
National Committee and Hillary Clinton’s campaign chairman, John
Podesta, were fed to WikiLeaks and the website DCLeaks,
which is run by self-described hacker Guccifer 2.0, who
researchers believe was a persona created by Russian military
intelligence. “The cat got out of the bag in terms of the tools used in the DNC
cyberattacks, so Fancy Bear upped the ante this time around,”
Martin said.








