PARIS: The same Russian government-aligned hackers who penetrated the Democratic Party have spent the past few months laying the groundwork for an espionage campaign against the US Senate, a cybersecurity firm said Friday.
The revelation suggests the group often nicknamed Fancy Bear, whose hacking campaign scrambled the 2016 US electoral contest, is still busy trying to gather the emails of America’s political elite.
“They’re still very active — in making preparations at least — to influence public opinion again,” said Feike Hacquebord, a security researcher at Trend Micro Inc., which published the report. “They are looking for information they might leak later.”
The Senate Sergeant at Arms office, which is responsible for the upper house’s security, declined to comment.
Hacquebord said he based his report on the discovery of a clutch of suspicious-looking websites dressed up to look like the US Senate’s internal email system. He then cross-referenced digital fingerprints associated with those sites to ones used almost exclusively by Fancy Bear, which his Tokyo-based firm dubs “Pawn Storm.”
Trend Micro previously drew international attention when it used an identical technique to uncover a set of decoy websites apparently set up to harvest emails from the French presidential candidate Emmanuel Macron’s campaign in April 2017. The sites’ discovery was followed two months later by a still-unexplained publication of private emails from several Macron staffers in the final days of the race.
Hacquebord said the rogue Senate sites — which were set up in June and September of 2017 — matched their French counterparts.
“That is exactly the way they attacked the Macron campaign in France,” he said.
Attribution is extremely tricky in the world of cybersecurity, where hackers routinely use misdirection and red herrings to fool their adversaries. But Tend Micro, which has followed Fancy Bear for years, said there could be no doubt.
“We are 100 percent sure that it can attributed to the Pawn Storm group,” said Rik Ferguson, one of the Hacquebord’s colleagues.
Like many cybersecurity companies, Trend Micro refuses to speculate publicly on who is behind such groups, referring to Pawn Storm only as having “Russia-related interests.” But the US intelligence community alleges that Russia’s military intelligence service pulls the hackers’ strings and a months-long Associated Press investigation into the group, drawing on a vast database of targets supplied by the cybersecurity firm Secureworks, has determined that the group is closely attuned to the Kremlin’s objectives.
If Fancy Bear has targeted the Senate over the past few months, it wouldn’t be the first time. An AP analysis of Secureworks’ list shows that several staffers there were targeted between 2015 and 2016.
Among them: Robert Zarate, now the national security adviser to Florida Senator Marco Rubio; Josh Holmes, a former chief of staff to Senate Majority Leader Mitch McConnell who now runs a Washington consultancy; and Jason Thielman, the chief of staff to Montana Senator Steve Daines. A Congressional researcher specializing in national security issues was also targeted.
Fancy Bear’s interests aren’t limited to US politics; the group also appears to have the Olympics in mind.
Trend Micro’s report said the group had set up infrastructure aimed at collecting emails from a series of Olympic winter sports federations, including the International Ski Federation, the International Ice Hockey Federation, the International Bobsleigh & Skeleton Federation, the International Luge Federation and the International Biathlon Union.
The targeting of Olympic groups comes as relations between Russia and the International Olympic Committee are particularly fraught. Russian athletes are being forced to compete under a neutral flag in the upcoming Pyeongchang Olympics following an extraordinary doping scandal that has seen 43 athletes and several Russian officials banned for life. Amid speculation that Russia could retaliate by orchestrating the leak of prominent Olympic officials’ emails, cybersecurity firms including McAfee and ThreatConnect have picked up on signs that state-backed hackers are making moves against winter sports staff and anti-doping officials.
On Wednesday, a group that has brazenly adopted the Fancy Bear nickname began publishing what appeared to be Olympics and doping-related emails from between September 2016 and March 2017. The contents were largely unremarkable but their publication was covered extensively by Russian state media and some read the leak as a warning to Olympic officials not to press Moscow too hard over the doping scandal.
Whether any Senate emails could be published in such a way isn’t clear. Previous warnings that German lawmakers’ correspondence might be leaked by Fancy Bear ahead of last year’s election there appear to have come to nothing.
On the other hand, the group has previously dumped at least one US legislator’s correspondence onto the web.
One of the targets on Secureworks’ list was Colorado State Senator Andy Kerr, who said thousands of his emails were posted to an obscure section of the website DCLeaks — a web portal better known for publishing emails belonging to retired Gen. Colin Powell and various members of Hillary Clinton’s campaign — in late 2016.
Kerr said he was still bewildered as to why he was targeted. He said that while he supported transparency, “there should be some process and some system to it.
“It shouldn’t be up to a foreign government or some hacker to say what gets released and what shouldn’t.”
Russian hackers laying groundwork to spy on US Senate: Cybersecurity firm
Russian hackers laying groundwork to spy on US Senate: Cybersecurity firm
Elon Musk launches Starlink service in Indonesia
- Indonesia is the third Southeast Asian country where Starlink will operate
- Starlink expected to improve internet access for thousands of Indonesian health centers
JAKARTA: Elon Musk and Indonesian Health Minister Budi Gunadi Sadikin launched SpaceX’s satellite internet service on Sunday, aiming to boost connectivity in the world’s largest archipelago.
Musk, the billionaire head of SpaceX and Tesla, arrived in Bali by private jet on Sunday morning, before attending Starlink’s launch at a community health center in the provincial capital Denpasar.
Wearing a green batik shirt, he inaugurated Starlink together with Sadikin, Communications Minister Budi Arie Setiadi and Maritime, and Fisheries Minister Sakti Wahyu Trenggono, and said that the satellite service would help millions in Indonesia to access the internet.
“We’re focusing this event on Starlink and the benefits that high-bandwidth connectivity can bring to a rural island and to remote communities,” Musk told reporters in Denpasar.
“I think it’s really important to emphasize the importance of internet connectivity and how much of a life-changer that could be.”
Indonesia, an archipelagic state comprising over 17,000 islands, is home to more than 270 million people and three different time zones. Following the launch, Musk said that internet connectivity was also integral for learning and business.
“You can learn anything if you’re connected to the internet, but if you’re not connected, it’s very difficult to learn,” Musk said. “And then if you have some virtual services that you wish to sell to the world, even if you’re in a remote village, you can now do so with an internet connection. So, it can bring a lot of prosperity, I think, to rural communities.”
Indonesia is the third Southeast Asian country where Starlink will operate. Neighboring Malaysia issued the firm a license to provide internet services last year, while a Philippine-based firm signed a deal with SpaceX in 2022.
On Sunday, Starlink was launched at three Indonesian health centers, two of which are located in Bali and one on the remote island of Aru in Maluku. Officials say the services will be prioritized for health and education, and in outer and underdeveloped regions.
Starlink is expected to bring high-speed connectivity to thousands of health centers across the country, Sadikin said, allowing Indonesians in remote areas to access services that were previously not available to them.
“With Starlink … 2,700 community health centers that had difficulties getting internet access and another 700 that didn’t have internet access, now can have them. So, the services will not differ with health centers … that are located in the cities,” the health minister said.
The arrival of Starlink in Indonesia is expected to boost equal internet access across Southeast Asia’s largest economy.
“A satellite-based internet service like Starlink will certainly be very beneficial for the country because there are still many regions which don’t have internet access,” said Pratama Persadha, chairman of the Communication and Information System Security Research Center.
Other sectors in Indonesia, such as education and the digital economy, will also get a boost from Starlink, he added.
“Wherever the location that requires good internet connection, whether on top of the mountain, in the middle of the forest, or in the middle of the sea, they can still enjoy the internet through satellite-based services like this.”
Suspected rebels kill political activist in Indian-administered Kashmir
- Two Indian tourists visiting the Himalayan territory were also wounded in a separate attack in Anantnag
- Rebel groups opposed to Indian rule have for decades waged an insurgency in Indian-controlled Kashmir
NEW DELHI: Suspected rebels shot dead an activist from Indian Prime Minister Narendra Modi’s party in Indian-administered Kashmir, local authorities said Sunday after the latest violent attack in the disputed region.
Police named the victim as Aijaz Ahmad, a local leader of the ruling Bharatiya Janata Party (BJP) who was fired upon in Shopian district on Saturday evening, days after the region began voting in India’s six-week national elections.
The BJP’s local office in Kashmir confirmed Sunday that Ahmad had died and announced plans to stage a protest against the attack.
Two Indian tourists visiting the Himalayan territory were also wounded in a separate attack by suspected rebels in nearby Anantnag on the same day, police said, adding that both had been hospitalized.
Security forces had cordoned off the surrounding area to find those responsible for separate incidents, police said.
Kashmir has been divided between India and Pakistan since their independence in 1947, with both claiming the Himalayan territory in full.
Rebel groups opposed to Indian rule have for decades waged an insurgency in Indian-controlled Kashmir, demanding either independence or a merger with Pakistan.
India accuses Pakistan of backing the militants — charges Islamabad denies.
The conflict has left tens of thousands of civilians, soldiers and militants dead.
Violence has drastically reduced since 2019, when Modi’s government canceled the Muslim-majority region’s limited autonomy and brought it under direct rule from New Delhi.
Security forces have reported a spate of clashes in Kashmir since voting began last month in ongoing general election.
Earlier this month suspected rebels killed an Indian air force member and injured four others in an ambush on a military convoy.
Pakistani students return from Kyrgyzstan after mob violence in Bishkek
- At least 5 Pakistani citizens injured in clashes in Bishkek
- Islamabad is arranging special flights to get students home
ISLAMABAD: The Pakistani government has repatriated 140 students from Kyrgyzstan after mobs attacked foreign citizens in the capital, Bishkek, over the weekend.
A special flight bringing the first batch of Pakistani students home landed at an airport in Lahore on Saturday night, with Islamabad planning to use more such flights to bring back citizens who want to leave Bishkek after violent incidents in the Kyrgyz capital.
On Friday, hundreds of Kyrgyz men in Bishkek attacked buildings where foreign students live, including Pakistan citizens who are among thousands studying and working in the Central Asian country.
The angry mob reportedly targeted these residences after videos of a brawl earlier this month between Krygyz and Egyptian students went viral online, prompting anti-foreigner sentiment over the past week. The Kyrgyz government deployed forces on Friday to mitigate the violence.
“Our first concern is the safe return of Pakistani students,” Interior Minister Mohsin Naqvi said.
“God willing, more students would be brought back via additional flights (on Sunday).”
Students who spoke to Arab News said that the Pakistan Embassy in Kyrgyzstan advised them to stay indoors after the mob attack. But when they ran out of food and water and some became fearful of potential riots, they asked authorities to evacuate them.
Pakistan’s Prime Minister Shehbaz Sharif said that the return to Pakistan of citizens who wished to do so would be “facilitated at the government’s expense.”
Sharif is sending a two-member delegation, including Deputy Prime Minister Ishaq Dar, to Bishkek on Sunday to meet with Kyrgyz officials and provide assistance for Pakistani students.
“The decision to send this delegation was made to ensure necessary support and facilities for Pakistani students,” a statement issued by Sharif’s office reads.
Pakistan’s foreign ministry said on Saturday it had summoned and handed a note of protest to Kyrgyzstan’s top diplomat in the country in response to the violence in Bishkek.
Five Pakistani medical students were injured in the mob attack, Pakistan’s Ambassador to Kyrgyzstan Hassan Zaigham said, with one student admitted to a local hospital with a jaw injury.
“No Pakistani was killed or raped in the violence,” he told Arab News over the phone, dispelling rumors circulating on social media.
“The situation is under control now as Bishkek authorities have dispersed all the miscreants.”
Tourist couple injured in shooting in India’s Kashmir amid elections
- Condition of Indian couple from Jaipur city is said to be stable, police say
- India is in a marathon election with two Kashmir seats to be contested on May 20, 25
SRINAGAR: A tourist couple was injured in India’s Kashmir after militants fired on them late on Saturday night, police said, ahead of voting scheduled in the volatile region for India’s ongoing election.
The couple from the Indian city of Jaipur was evacuated to the hospital and the area where the attack took place was cordoned off, Kashmir police said on social media. The condition of the injured tourists is said to be stable, they said.
India is in the middle of a marathon election with the remaining two seats in Kashmir going to polls on May 20 and May 25.
Voters turned out in large numbers for polling in the first seat in Srinagar on May 13, reversing the trend of low vote counts in the first polls since Prime Minister Narendra Modi removed the region’s semi-autonomy in 2019.
Modi’s Bharatiya Janata Party (BJP) is skipping elections in Kashmir for the first time since 1996 saying it will support regional parties instead.
Major parties in Kashmir, the National Conference and People’s Democratic Party (PDP), have focused on restoration of semi-autonomy in their campaigns.
Analysts and opposition parties say the BJP is not contesting elections in Kashmir because it fears the outcome will contradict its narrative of a more peaceful and integrated region since 2019.
In a separate incident, unknown militants shot dead former village headman and BJP party member Ajiaz Ahmad Sheikh in Shopian district on Saturday.
The last major attack on tourists in Kashmir had happened in 2017 when a Hindu pilgrimage bus was targeted, killing eight people.
Tourists wounded in deadly Afghanistan shooting stable — hospital
- Group of tourists was fired at while shopping in mountainous city of Bamiyan on Friday
- Attack first deadly assault on foreign tourists since Taliban’s return to power in 20221
KABUL: Tourists wounded in an attack in Afghanistan which left three Spaniards and three Afghans dead were in a stable condition, a hospital said Saturday, as a survivor described the horror of the shooting in an open market.
The group was fired on while shopping in the bazaar in the mountainous city of Bamiyan, around 180 kilometers (110 miles) from the capital Kabul, on Friday.
French tourist Anne-France Brill, one of the dozen foreign travelers on an organized tour, said a gunman on foot approached the group’s vehicles and opened fire.
“There was blood everywhere,” the 55-year-old told AFP from Dubai, where she landed Saturday after being evacuated from Kabul with two Americans.
“One thing is certain,” she said, the assailant “was there for the foreigners.”
Brill, who works in marketing and lives near Paris, said she helped collect the bloodied belongings of her wounded fellow travelers before a Taliban escort brought them to the capital, where they were taken in by a European Union delegation.
The attack is believed to be the first deadly assault on foreign tourists since the Taliban returned to power in 2021 in a country where few nations have a diplomatic presence.
The bodies of those killed were transported to Kabul overnight Friday, along with the wounded and survivors, after bad weather made an airlift impossible.
Italian NGO Emergency, which operates a hospital in Kabul, received the injured who it said were from Spain, Lithuania, Norway, Australia and Afghanistan.
“The wounded people arrived at our hospital at 3:00 am (2230 GMT Friday) this morning, about 10 hours after the incident took place,” said Dejan Panic, Emergency’s country director in Afghanistan, in a statement.
“The Afghan national was the most critically injured, but all patients are now stable,” he added.
Spain’s government on Friday announced that three of the dead were Spanish tourists.
Its foreign ministry said one of the wounded was also a Spanish woman, who had been seriously injured and underwent surgery in Kabul.
The dead included three Afghans — two civilians and a Taliban member, the government’s interior ministry spokesman Abdul Mateen Qani said.
Local officials said the civilians were working with the tour group, while the Taliban security official had returned fire when the shooting broke out.
“Overwhelmed by the news of the murder of Spanish tourists in Afghanistan,” Prime Minister Pedro Sanchez posted on social media platform X.
The bodies of the dead would likely be brought back to Spain on Sunday, the country’s foreign minister Jose Manuel Albares said on Spanish public television TVE.
Spanish diplomats were headed to Afghanistan from Pakistan and Qatar, where the Spanish ambassador to the country is currently based.
The Spanish embassy was evacuated in 2021, along with other Western missions, after the Taliban took back control of Kabul, ending a bloody decades-long insurgency against foreign forces.
Spanish authorities have also been coordinating with a European Union delegation in the capital.
Interior ministry spokesman Qani said seven suspects had been arrested, “of which one is wounded.”
“The investigation is still going on and the Islamic Emirate is seriously looking into the matter,” he added.
There has not yet been a claim of responsibility.
The EU condemned the attack “in the strongest terms.”
The United Nations mission in Afghanistan, UNAMA, said it was “deeply shocked and appalled by the deadly terrorist attack” in Bamiyan, adding it had provided assistance after the incident.
The Taliban government has yet to be officially recognized by any foreign government.
It has, however, supported a fledgling tourism sector, with more than 5,000 foreign tourists visiting Afghanistan in 2023, according to official figures.
Western nations advise against all travel to the country, warning of kidnap and attack risks.
Alongside security concerns, the country has limited road infrastructure and a dilapidated health service.
Multiple foreign tourism companies offer guided package tours to Afghanistan, often including visits to highlights in cities such as Herat, Mazar-i-Sharif and Bamiyan.
Bamiyan is Afghanistan’s top tourist destination, once home to the giant Buddha statues that were blown up by the Taliban in 2001 during their previous rule.
The number of bombings and suicide attacks in Afghanistan has fallen dramatically since the Taliban authorities took power, and deadly attacks on foreigners are rare.
However, a number of armed groups, including Daesh, remain a threat.
The group has waged a campaign of attacks on foreign interests in a bid to weaken the Taliban government, targeting the Pakistani and Russian embassies as well as Chinese businessmen.
