The Plot to Hack America

The administrators of the official ActBlue.com site stated they were never hacked and that no information on donors in their systems was compromised.³⁸

The DCCC did not officially disclose what data had been stolen. However, shortly after the leak was announced the account associated with “Guccifer 2.0” claimed responsibility. On August 12, 2016 they published a trove of internal emails, memos and other data. In particular, there was a memo from Troy Perry, a DCCC employee who advised others on how to handle activists in the Black Lives Matters campaign. He suggested to “listen to their concern but do not offer support for concrete policy decisions.”

As a result of publishing the DCCC information, Twitter suspended the Guccifer 2.0 account.³⁹ WordPress too took action… in a way. They stepped in and scrubbed the website of posts related to the DCCC hack and sent a reminder to Guccifer 2.0 of its Terms of Service related to publishing private information. The laughter in the LUCKY-7 Information Warfare Management (IWMC) cell must have been raucous when the sternly-worded letter about monkey-wrenching an entire American election was read aloud.

Clinton Campaign Hack

Trumps wish for Russia to get more data continued apace. On July 29, 2016, Clinton campaign spokesman Nick Merrill said, “Our campaign computer system has been under review by outside cyber security experts. To date, they have found no evidence that our internal systems have been compromised.”⁴⁰ This was political lingo to say the campaign had been visited by the CYBER BEARS but they hadn’t found the actual hack yet.

In fact the CYBER BEARS did attack the Clinton servers, but their access was limited. The attackers managed to access a server used for the campaign’s analytics program that stores voter analysis. There is no other sensitive data on those machines and the campaign said the internal computer systems had not been compromised. Still, the Russians now knew more about how the Clinton campaign analyzed voter data. Nothing is ever too obscure for cyber theft.

The techniques the CYBER BEARs used to attack were the same as the others. An email was sent to 108 Hillary for America email addresses, containing a short link pointing to a fake Google sign-in. The target enters their Gmail email and password and then—poof!—it belongs to Mother Russia.

SecureWorks determined 213 links were sent. Because SecureWorks could only find just over half of the 108 Gmail accounts, they determined the hackers got the emails from another source.⁴¹ The emails were aimed at specific figures that held rank in the campaign. Out of the 213 links generated by the hackers, 20 had been clicked at least once. Eight people clicked the links at least twice; two of those clicked them four times. In addition, 26 personal accounts for Clinton campaign staffers were targeted in 150 short links specifically created to target this group.

The DNC uses dnc.org as its mail server for staff email. SecureWorks reported that sixteen short links were sent to nine specific accounts at the DNC. At least three senior Clinton staff members clicked on these short links. SecureWorks did not link these emails specifically to the DNC hack, but did affirm the same spear-phishing technique was used.⁴² In its brief on the HillaryClinton.com hack, SecureWorks refers to “TG-4127” and designated it as APT28 COZY BEAR.

Now that their tears of laughter had dried from the stern warning from Wordpress, the CYBER BEARS paid no heed and started to issue more stolen DNC documents, including “DCCC internal docs on primaries in Florida.” However, a telling clue of the releases started to reveal itself. While Guccifer 2.0 released some documents randomly in order to incite Sanders die-hards, others followed a certain parameter, indicating that the Russian IWMC was paying close attention to what the Trump campaign said and then released documents to support Trump’s statements. The most telling was the week long storm the Trump campaign made by claiming that if he didn’t win in Pennsylvania, then the election was stolen. Speaking in Altoona on August 12, he said “We’re going to watch Pennsylvania. Go down to certain areas and watch and study and make sure other people don’t come in and vote five times. If you do that, we’re not going to lose. The only way we can lose, in my opinion—I really mean this, Pennsylvania—is if cheating goes on.” Little more than a week later, Guccifer 2.0 posted “DCCC Docs Pennsylvania.” They would soon be followed up with leak of DNC material from virtually all of the swing states of Florida, Ohio, New Hampshire, Illinois and North Carolina just when Trump needed a boost in the polls.