The Plot to Hack America

Speaking to the American press conference when asked about the subject of hacking Trump brought up the private Hillary Clinton emails deleted from her server. Trump blurted out, “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing… I think you will probably be rewarded mightily by our press.”³⁰ Almost immediately a media storm shook the campaign and people wondered aloud if Trump was actually in league with the Kremlin. It made some wonder if the comments made by Fox News’s Andrew Napolitano in May—stating that Russia was engaged in an inter-Kremlin argument about whether to release Clinton’s hacked emails—was tied to Trump’s call to release them. Did Team trump have advance knowledge of what the Kremlin was doing?

In another strange twist, Trump ally Roger Stone would later claim to be in direct communication with the WikiLeaks founder Julian Assange. “I actually have communicated with Assange,” Stone said. “I believe the next tranche of his documents pertain to the Clinton Foundation but there’s no telling what the October surprise may be.”³¹ While Stone has no official role in the Trump campaign, Roll Call writes that he “might have inadvertently linked the Donald Trump campaign with the WikiLeaks founder Julian Assange.”³²

The Kremlin certainly could no longer express shock and surprise now that they had been asked publically to do what they had been doing since 2015. All that could be done for LUCKY-7 was to keep up the flow of email releases in the hope that Trump does not damage or discredit the hacks any further.

American presidential elections are high-stakes events. Russia would not be the first foreign power, friendly or hostile, to pursue its preferred outcome. Nor would Mr. Trump be the first politician to leverage foreign actors for electoral benefit. But this is the first time that a presidential candidate had openly asked a foreign power to meddle in the democratic process to his benefit. More than that, Mr. Trump seemed to be suggesting that Russia should violate United States espionage laws on his behalf.³³ To members of the U.S. intelligence community, the indications that nefarious practitioners were playing in the most dangerous of games was now confirmed. The first question that popped into the minds of many practitioners was, “What does Trump know that we do not?” The implication would naturally cause counterintelligence and cyberwarfare operatives ask themselves if there is there a link between Trump or his supporters and the Russians in the DNC hacks?

The DCCC and ActBlue Hacks

The next day after Trumps begging Russia to hack America the CYBER BEARS complied. On July 28, the Democratic Congressional Campaign Committee announced it was attacked by the CYBER BEARS. The DCCC is focused on raising funds for Democratic congressional campaigns and managing the finances of the senatorial campaign donations. This hack used Typosquatting, building a fake website identical to the DCCC’s where staff and donors sign-in information was stolen. It used spear-phishing techniques to gain entry, and was focused on an effort to gain general information from the DCCC. The CYBER BEARS managed to steal much more personal data about the donors and supporters of the party from the DCCC than the DNC, including information on credit card numbers, personal information, and addresses.³⁴ Since the effort placed so much emphasis on donors, the mission was most likely intended to create doubts about the security of the Democratic Party’s control of financial information and reduce donations.

Reuters announced the attack just before the DNC’s grand evening, the Hillary Clinton Acceptance speech in Philadelphia. On the eve of Clinton’s speech, the DCCC’s spokeswoman said in a statement, “The DCCC takes this matter very seriously. With the assistance of leading experts, we have taken and are continuing to take steps to enhance the security of our network in the face of these recent events. We are cooperating with the federal law enforcement with respect to their ongoing investigation.”³⁵

ActBlue.com is the official site for fundraising that donors thought they were going to when they wound up at ActBlues.com which was a fake watering hole site complete with a malware packaged ready to steal data.³⁶ ActBlues.com was being hosted on a machine with a Netherlands IP address. The site had been registered to a Gmail account, fisterboks@gmail.com, which had registered three other sites used as German cover for Russian spear-phishing campaigns. Cyber security companies ThreatConnect and Fidelis concluded that the Gmail was tied to domains associated with the DNC hack related to “misdepatrment.com.” That domain was registered to frank_merdeux@europe.com and was used as the C2 server in the DNC attack.³⁷ The CYBER BEARS had struck again.