Thread by @razhael

Our latest on Fancy Bear, this time relying on new research from @TrendMicro

External Tweet loading...
If nothing shows, it may have been deleted
by @ap view original on Twitter

Pawn Storm group - also known as APT28 or Fancy Bear - has been caught creating phishing sites aimed at ensnaring US Senate staffers, @TrendMicro says. Olympic winter sports federations also targeted.
apnews.com/9a6888c2163f43…

Trend Micro says this recent pattern of activity is identical to the Pawn Storm phishing websites allegedly set up to steal messages from @enmarchefr back in spring of last year
apnews.com/9a6888c2163f43…

Pawn Storm's targeting of Senate staff makes sense given what @AP has seen from @Secureworks' data.
Group has previously tried to hit:
* A foreign policy adviser to @marcorubio (advising @SenatorKirk at the time)
* Chief of staff for @SteveDaines
* Ex-CoS for @SenateMajLdr

Worth noting that high-profile political targets are typical targets for espionage of all stripes. What makes Fancy Bear’s targeting so newsworthy is its tendency to leak.
That said, fears that something similar would happen in Germany never came to pass.
politico.eu/article/russia…

Here's @TrendMicro's report:
blog.trendmicro.com/trendlabs-secu…
(with US Senate-themed IOCs highlighted)

Right, good point. There's nothing particularly unusual about spies (Russian or otherwise) seeking private information, for example, a senator's staff.
But given Fancy Bear's link to previous political interventions, this operation may be worth watching.

External Tweet loading...
If nothing shows, it may have been deleted
by @NateBeachW view original on Twitter

Also targeted by Pawn Storm, according to Trend:

@FIS_news 🏂⛷🎿
@IIHFHockey 🏒
@FIL_Luge 🛷
@biathlonworld 🎿🔫
@ibsfsliding 🏄‍♂️

apnews.com/9a6888c2163f43…

Hard to say what this will mean in the medium term. Winter Olympics and US midterm elections may have a dash of cyber-intrigue ... or they may not.

I didn't include it in our story, but lest we get too America-focused, @TrendMicro also found evidence of spying tied to the 2017 presidential election in Iran.
blog.trendmicro.com/trendlabs-secu…

This should emphasize, as our own investigation into Fancy Bear has, that this is a group - like any other major nation-state group - focused on maintaining a global intelligence network. US political meddling only gives small window into their operations.