Skip to main content

Kremlin disinformation tactics stir new action

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.
Feb 20, 2024 View in browser
 
POLITICO's Weekly Cybersecurity newsletter logo

By Joseph Gedeon

With help from Maggie Miller and Antoaneta Roussi

Driving the day

— Democracies face a critical test as a Kremlin-backed disinfo war targets vital health care efforts in Africa, with growing concern over the attacks kickstarting the first steps of a global counteroffensive.

HAPPY TUESDAY, and welcome to MORNING CYBERSECURITY! The Hill is off this next week, and with no more football, now I need to find a hobby to fill the downtime. Is it bird watching season or something? Or maybe I should just try to turn to more of these steroid-esque hockey games.

Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Find me on X at @JGedeon1 or email me at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below.

 

SUBSCRIBE TO GLOBAL PLAYBOOK: Don’t miss out on POLITICO’s Global Playbook, the newsletter taking you inside pivotal discussions at the most influential gatherings in the world, including WEF in Davos, Milken Global in Beverly Hills, to UNGA in NYC and many more. Suzanne Lynch delivers the world's elite and influential moments directly to you. Stay in the global loop. SUBSCRIBE NOW.

 
 

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

Today's Agenda

The Pentagon’s chief digital and AI officer, Craig Martell, is heading to the Defense Department’s Advantage DOD 24 Defense Data and AI Symposium, which kicks off today. 12:30 p.m.

At the Agencies

DISINFO WAR — A Kremlin-backed disinformation campaign aimed at disrupting Western health care efforts in Africa has set off alarm bells within the global intelligence community, prompting the United States and its allies to launch a coordinated counteroffensive.

U.S. envoy James Rubin, who heads the State Department's Global Engagement Center meant to expose and counter foreign state-backed disinformation attacks, told MC he met with American, British and Canadian counterparts at the Munich Security Conference to organize the first phase of a united front against Moscow’s disinformation globally.

“We're in a phase of information warfare in the continent of Africa and around the world where the Kremlin believes that they can benefit from conducting these operations,” Rubin told MC.

The news comes after the Munich Security Conference’s annual risk report showed a spike in global leaders’ concerns about AI-powered threats, with cyberattacks and disinformation campaigns also ranking highly among top security worries. With more than 50 elections worldwide this year, the revelations offer sobering lessons for democracies facing modern information warfare.

— Operation details: Dubbed the “African Initiative,” Russia’s disinfo outfit recruits local African journalists and influencers to launder anti-Western narratives undermining U.S. and European medical assistance across the continent.

It blurs the line between legitimate grievances over Western colonization and outright conspiracy theories blaming Western doctors for disease outbreaks — targeting millions across dozens of African countries.

The local offices for the “African Initiative” had been uncovered in both Burkina Faso and Mali, in western Africa.

— Early intervention: But Rubin believes the Africa-focused operation was detected early enough to prevent significant impact. After the first fabricated narratives blaming Western medics for disease outbreaks appeared, the U.S. rapidly alerted journalists, governments and health workers across Africa. This quick exposure is hoped to have blunted the disinformation before it could widely propagate.

"We believe we have captured real disinformation so early that that will prevent the campaign from having significant success," Rubin said.

— Wagner is alive: Rubin warned that operatives tied to Russia’s notorious Wagner Group “still exist” and remain dangerous. Some staff were recruited from the disbanded troll farms of late oligarch Yevgeny Prigozhin, who already had disinfo officers scattered across the continent.

And with many Russian operatives expelled from Europe due to the war in Ukraine, Africa may now be emerging as a key battleground for the global information war — and a testing ground for global attacks. And Russia already has a foothold in the continent’s disinformation landscape: A 2022 report from the Africa Center for Strategic Studies identified 23 campaigns across several countries in Africa, with 16 operations linked to the Kremlin.

— Not easy work: Concerns about Russia's evolving tactics are further amplified by a new report from the Center for the Study of Democracy in Europe, which details Russia integrating evolving cyber capabilities into disinfo efforts along NATO’s eastern edge.

The report found that the Kremlin is using a combination of open and hidden methods in its attacks. They mix military and civilian targets and try to twist a dagger into divisions of society for their advantage. And one way it launches those attacks has been by creating fake websites for foreign institutions.

Rubin admitted combating these influence campaigns remains an uphill battle, citing the openness of Western social platforms versus closed systems in Russia and China.

“The rest of the world can’t operate inside Russia and China,” Rubin said. “So there is a fundamental asymmetry here, for any damage they can do.”

NSA DISCLOSURE — A prolific Chinese government-linked hacking group has not yet been deterred from attacking and burrowing into critical U.S. networks, despite a full-court press by the Biden administration to call them out.

An official at the National Security Agency, not authorized to speak publicly as a matter of practice, told Maggie that Chinese hacking group Volt Typhoon is continuing its efforts. The comment was made following reporting from operational technology cybersecurity group Dragos that Volt Typhoon had targeted the emergency services networks of an unnamed large U.S. city.

“Industry and incident response reporting reflects that new incidents tied to Volt Typhoon are happening every day – demonstrating that their activities have not slowed down or ceased since their activities have been called out publicly,” the official said.

The NSA was among the U.S. and foreign allied agencies that signed on to an alert sent out earlier this month warning of Volt Typhoon’s malicious activities, and noting that the group had been in U.S. networks for “at least five years.”

— Some background: That alert was put out the same week that top officials, including former NSA director Gen. Paul Nakasone, appeared before the House Select Committee on China to publicly warn of mounting cyber threats from Beijing to U.S. critical networks. These include military systems on the U.S. territory of Guam, along with hundreds of smaller routers on the mainland, according to the Justice Department.

The official said that as a result of the ongoing threat, the NSA and other U.S. agencies will “continue to release public cybersecurity advisories” pertaining to Volt Typhoon in the future.

— Beijing hits back: The Chinese government has denied the allegations of hacking, and instead called out the U.S. for similar actions. Chinese Foreign Ministry spokesperson Mao Ning said at a press conference Monday that the “U.S. jumped to an unwarranted conclusion” about Chinese hacking efforts, describing this as a “distortion of facts.”

“The U.S. needs to stop its worldwide cyber espionage and cyberattacks, and stop smearing other countries under the excuse of cybersecurity,” Mao said.

 

DON’T MISS POLITICO’S GOVERNORS SUMMIT: Join POLITICO on Feb. 22 to dive into how Governors are wielding immense power. While Washington remains gridlocked, governors are at the center of landmark decisions in AI and tech, economic development, infrastructure, housing, reproductive health and energy. How are they setting the stage for the future of American politics, policies and priorities? How are they confronting major challenges? Explore these questions and more at the 2024 Governors Summit. REGISTER HERE.

 
 
The International Scene

PRO-CURBING SPYWARE — The former chief of the United Kingdom’s Secret Intelligence Service (MI6) is a fan of the new initiative to curb intrusive cyber tool proliferation, called the Pall Mall Process.

Speaking during a panel at the Munich Cyber Security Conference last week, Sir Alex Younger said he was “aghast” with the “casual way” that both state and nonstate actors were using spyware.

“Utterly irresponsible; we wouldn’t tolerate it in the nuclear space,” he said. “I don’t think anybody underestimates the diplomatic challenges of this — but it’s in everybody’s interest notwithstanding their geopolitical position to see these tools controlled.”

— Who signed on?: The United States, the United Kingdom, the African Union and EU members including France, Belgium and Italy. On the industry side, defense firm BAE Systems, Apple, Google, Meta and Microsoft.

Among the signatories of the declaration was Greece, whose sitting government was embroiled in a huge spyware scandal in August 2022. Still, the former spy boss said the group needed to include as many countries as possible — including China, India and Russia — because an initiative that became “one bloc against the other” wouldn’t achieve anything.

— Next step, endorsements: Well, according to Younger, “there is no external policeman here … We have to bring together a group and go together at the speed everyone will tolerate.”

We feel relieved already.

Vulnerabilities

OT UNDER SIEGE — Industrial organizations face a growing storm of cyber threats, with ransomware attacks surging 50 percent in 2023 as three new threat groups joined the fray, according to the Dragos OT cybersecurity year in review report.

The report confirms ransomware's dominance, with Lockbit, ALPHV and BlackBasta leading the charge. Manufacturing bore the brunt of the attacks, accounting for 71 percent of incidents, primarily targeting North America and Europe.

— Ready, new players: The report introduces three new threat groups: VOLTZITE, linked to China's Volt Typhoon; Moscow-backed GANANITE targeting CIS and Central Asia; and LAURIONITE, focused on Oracle E-Business Suite vulnerabilities.

According to Dragos, VOLTZITE conducted prolonged surveillance of utilities and satellite providers to gather intelligence across Asia, Africa and North America, while GANANITE stole data from government and critical infrastructure companies in former Soviet states.

— Breaking new ground: For the first time, Tehran-linked hacktivist collective CyberAv3ngers breached programmable logic controllers at water facilities in North America and Europe in an anti-Israel hacking campaign. While hacktivists typically launch disruptive attacks meant to overload a network, CyberAv3ngers demonstrated the ability to infiltrate operational technology by exploiting weak security controls.

The White House told MC back in January it was aware of at least 18 water facilities across the United States being affected by those attacks.

It also shows how geopolitical tensions escalate cyberattacks, with Russia’s war in Ukraine emboldening established groups like ELECTRUM, while China-Taiwan tensions in the lead-up to the island nation’s election fueled targeted cyber espionage in the Asia-Pacific region and the United States.

Tweet of the Day

Sometimes you can’t help but be a good sport about it.

Source: https://twitter.com/vxunderground/status/1759697172101022176

Quick Bytes

HIMES SPEAKS — The ranking member on the House Intelligence Committee, Rep. Jim Himes (D-Conn.). joined POLITICO’s Ryan Lizza on the Playbook Deep Dive podcast to explain the backstory on last week’s warning of a serious national security threat, and what it did for Section 702 reform.

TROJAN ALERT —  A Chinese cybercrime group developed an iOS trojan called GoldPickaxe to steal bank account details from victims in the Asia-Pacific region, writes Eduard Kovacs for SecurityWeek.

Revealed: The respectable life of the suspected Medibank hacker (The Australian Financial Review)

Chat soon. 

Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis (jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Heidi Vogt (hvogt@politico.com).

 

Follow us on Twitter

Heidi Vogt @HeidiVogt

Maggie Miller @magmill95

John Sakellariadis @johnnysaks130

Joseph Gedeon @JGedeon1

 

Follow us

Follow us on Facebook Follow us on Twitter Follow us on Instagram Listen on Apple Podcast
 

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings

This email was sent to rouf@idiot.cloudns.cc by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

Unsubscribe | Privacy Policy | Terms of Service

Comments

Popular Posts

📄 Liaqat Ali Ali shared Waheed Zaman's post

  See the post that he shared.           Facebook                 📄 Liaqat Ali Ali shared Waheed Zaman 's post. 26 April at 12:09   View               This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more      

📄 Sazzad Khan shared Shakil Khan's post

  Ludo, see the post that he shared.           Facebook                 📄 Sazzad Khan shared Shakil Khan 's post. 27 April at 21:42   View               This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more      

Afjal Hossain wants to be friends on Facebook

  1 mutual friend - Works at won businass - Atrai, Rājshāhi, Bangladesh - 3,883 friends - 6 photos - 3 groups           Facebook             Afjal Hossain wants to be friends with you on Facebook.   Afjal Hossain Works at won businass · Atrai, Rājshāhi, Bangladesh 1 mutual friend · 3,883 friends · 6 photos · 3 groups               Confirm request     See all requests             This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more.      

DeepMind Gemini AI could rival ChatGPT / Congress restricts ChatGPT use / Unity launches AI marketplace

Plus: C-suite leaders plan to hire due to generative AI Inside AI For June 27, 2023 Thank you to our sponsor Hey Insiders,  Welcome to Inside AI! Here are today's top stories: Google DeepMind is developing a Gemini chatbot to rival ChatGPT. 64% of C-suite leaders say they plan to increase hiring due to generative AI. U.S. House members were instructed to limit ChatGPT usage to the paid version. Scroll down for some quick hits, and then let us know what other content you'd like to see in future issues!  Beth p/beth-duckett 1 Google DeepMind, its AI research lab, is developing a new chatbot called Gemini that could rival or surpass OpenAI's ChatGPT, according to CEO Demis Hassabis. Gemini, built on the capabilities of DeepMind's AlphaGo AI system, could analyze text, plan, and solve problems, Hassabis told Wired. More: AlphaGo is DeepMind's AI system that defeated a professional human player i...

The $975 million TikTok mystery

Red flags pile up in Khaby Lame’s mega deal. View in browser | Subscribe ...

Breaking News: Dems fall short of flipping deep-red House seat in surprisingly competitive Tennessee special election

Dems fall short of flipping deep-red House seat in surprisingly competitive Tennessee special election Breaking News Alert ...

Start separating your leaves from your trash

Presented by Uber: POLITICO's must-read briefing informing the daily conversation among knowledgeable New Yorkers May 31, 2023 View in browser   By Danielle Muoio Dunn and Zachary Schermele Presented by ...

Meta removes disinformation campaigns / Google Maps disables features in Ukraine / NIO seeks HK listing

Plus: OnePlus's upcoming phone can fully charge in 15 minutes. Inside.com Part of   Network February 28, 2022 Presented by Facebook parent company Meta said it took down two disinformation campaigns that targeted Ukraine and were spreading anti-Ukrainian propaganda. Russia-linked hacking group Ghostwriter, which perpetrated one of the campaigns, gained access to real Facebook accounts and posted YouTube videos "portraying Ukrainian troops as weak and surrendering to Russia," according to Meta. The company said it blocked phishing domains that Ghostwriter used to gain access to the accounts and beefed up security. More: Meta described the second disinformation campaign as "coordinated inauthentic behavior" made up of about 40 accounts, pages, and groups on Facebook and Instagram.  The campaign ran several websites disguised as independent...

The 2021 Holiday Magic Gift Guide + $610 in free gifts

The response to our Black Friday Sale  has already been overwhelming (over $600 in free magic), but I've gotten a ton of emails asking my advice on what to buy. So here's a list of my personal hand-picked recommendations . Whether you're buying these for yourself or someone else, they're all excellent, and get my highest recommendations. The 2021 Penguin Magic Holiday Gift Guide (organized by category) Gingerbread Playing Cards: A very limited 2021 edition holiday deck of playing cards. Free with every order o...

Only 12 hours left to get over $600 in free magic. Black Friday ends at midnight!

At midnight tonight, our Black Friday sale disappears! For the next 12 hours, every order gets a free trick , STAB by Luke Jermay , an incredible display of skill you need to know....

Popular Posts

📄 Liaqat Ali Ali shared Waheed Zaman's post

  See the post that he shared.           Facebook                 📄 Liaqat Ali Ali shared Waheed Zaman 's post. 26 April at 12:09   View               This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more      

📄 Sazzad Khan shared Shakil Khan's post

  Ludo, see the post that he shared.           Facebook                 📄 Sazzad Khan shared Shakil Khan 's post. 27 April at 21:42   View               This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more      

Afjal Hossain wants to be friends on Facebook

  1 mutual friend - Works at won businass - Atrai, Rājshāhi, Bangladesh - 3,883 friends - 6 photos - 3 groups           Facebook             Afjal Hossain wants to be friends with you on Facebook.   Afjal Hossain Works at won businass · Atrai, Rājshāhi, Bangladesh 1 mutual friend · 3,883 friends · 6 photos · 3 groups               Confirm request     See all requests             This message was sent to ludomallam@idiot.cloudns.cc . If you don't want to receive these emails from Facebook in the future, please unsubscribe . Facebook, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025         To help keep your account secure, please don't forward this email. Learn more.      

DeepMind Gemini AI could rival ChatGPT / Congress restricts ChatGPT use / Unity launches AI marketplace

Plus: C-suite leaders plan to hire due to generative AI Inside AI For June 27, 2023 Thank you to our sponsor Hey Insiders,  Welcome to Inside AI! Here are today's top stories: Google DeepMind is developing a Gemini chatbot to rival ChatGPT. 64% of C-suite leaders say they plan to increase hiring due to generative AI. U.S. House members were instructed to limit ChatGPT usage to the paid version. Scroll down for some quick hits, and then let us know what other content you'd like to see in future issues!  Beth p/beth-duckett 1 Google DeepMind, its AI research lab, is developing a new chatbot called Gemini that could rival or surpass OpenAI's ChatGPT, according to CEO Demis Hassabis. Gemini, built on the capabilities of DeepMind's AlphaGo AI system, could analyze text, plan, and solve problems, Hassabis told Wired. More: AlphaGo is DeepMind's AI system that defeated a professional human player i...

The $975 million TikTok mystery

Red flags pile up in Khaby Lame’s mega deal. View in browser | Subscribe ...

Breaking News: Dems fall short of flipping deep-red House seat in surprisingly competitive Tennessee special election

Dems fall short of flipping deep-red House seat in surprisingly competitive Tennessee special election Breaking News Alert ...

Start separating your leaves from your trash

Presented by Uber: POLITICO's must-read briefing informing the daily conversation among knowledgeable New Yorkers May 31, 2023 View in browser   By Danielle Muoio Dunn and Zachary Schermele Presented by ...

Meta removes disinformation campaigns / Google Maps disables features in Ukraine / NIO seeks HK listing

Plus: OnePlus's upcoming phone can fully charge in 15 minutes. Inside.com Part of   Network February 28, 2022 Presented by Facebook parent company Meta said it took down two disinformation campaigns that targeted Ukraine and were spreading anti-Ukrainian propaganda. Russia-linked hacking group Ghostwriter, which perpetrated one of the campaigns, gained access to real Facebook accounts and posted YouTube videos "portraying Ukrainian troops as weak and surrendering to Russia," according to Meta. The company said it blocked phishing domains that Ghostwriter used to gain access to the accounts and beefed up security. More: Meta described the second disinformation campaign as "coordinated inauthentic behavior" made up of about 40 accounts, pages, and groups on Facebook and Instagram.  The campaign ran several websites disguised as independent...

The 2021 Holiday Magic Gift Guide + $610 in free gifts

The response to our Black Friday Sale  has already been overwhelming (over $600 in free magic), but I've gotten a ton of emails asking my advice on what to buy. So here's a list of my personal hand-picked recommendations . Whether you're buying these for yourself or someone else, they're all excellent, and get my highest recommendations. The 2021 Penguin Magic Holiday Gift Guide (organized by category) Gingerbread Playing Cards: A very limited 2021 edition holiday deck of playing cards. Free with every order o...

Only 12 hours left to get over $600 in free magic. Black Friday ends at midnight!

At midnight tonight, our Black Friday sale disappears! For the next 12 hours, every order gets a free trick , STAB by Luke Jermay , an incredible display of skill you need to know....

Archive

Show more

Bottom Widget

Bottom Widget

font.css

videocontrol.css

GitFootCSS

BottomEdge Widget Title

Copyright © 2023 IdiotMail