The FBI has issued a Private Industry Notification warning of phishing emails designed to steal login credentials from election officials. The Bureau believes these attacks will increase ahead of the 2022 midterm elections; the officials who need to be alert are at the state, local, territorial, and tribal levels.
“The FBI is warning US election and other state and local government officials about invoice-themed phishing emails that could be used to harvest officials’ login credentials,” the alert says. “If successful, this activity may provide cyber actors with sustained, undetected access to a victim’s systems. As of October 2021, US election officials in at least nine states received invoice-themed phishing emails containing links to websites intended to steal login credentials. These emails shared similar attachment files, used compromised email addresses, and were sent close in time, suggesting a concerted effort to target US election officials.... The FBI judges cyber actors will likely continue or increase their targeting of US election officials with phishing campaigns in the lead-up to the 2022 US midterm elections.”
The FBI notes that in one instance, attackers used a hacked US government email account to send the phishing emails.
“On 5 October 2021, unidentified cyber actors targeted US election officials in at least nine states, and representatives of the National Association of Secretaries of State, with phishing emails,” the Bureau says. “These emails originated from at least two email addresses with the same attachment titled, ‘INVOICE INQUIRY.PDF,’ which redirected users to a credential harvesting website. One of the email addresses sending the phishing emails was a compromised US government official’s email account.”
The FBI recommends that organizations ensure that their employees know how to recognize social engineering attacks.
“Educate employees on how to identify phishing, spear-phishing, social engineering, and spoofing attempts,” the alert says. “Advise employees to be cautious when providing sensitive information – such as login credentials – electronically or over the phone, particularly if unsolicited or anomalous. Employees should confirm, if possible, requests for sensitive information through secondary channels.”
New-school security awareness training can enable your employees to thwart targeted phishing attacks.
