FBI Issues Warning to Election and Other Officials About Login Harvesting Scheme

WASHINGTON — The Federal Bureau of Investigation issued a warning to election and other state and local government officials about invoice-themed phishing emails that could be used to harvest officials’ login information.

If successful, the agency warned in a “Private Industry Notification” released Thursday, “this activity may provide cyber actors with sustained, undetected access to a victim’s systems.”

The notification says that on Oct. 5, 2021, U.S. election officials in at least nine states and representatives of the National Association of Secretaries of State received invoice-themed phishing emails containing links to websites intended to steal login credentials. 

These emails shared similar attachment files, used compromised email addresses, and were sent close in time, suggesting a concerted effort to target U.S. election officials. 

These emails originated from at least two email addresses with the same attachment titled, “INVOICE INQUIRY.PDF,” which redirected users to a credential-harvesting website. 

One of the email addresses sending the phishing emails was a compromised U.S. government official’s email account.  

Then on Oct. 18, 2021, cyber actors used two email addresses, purportedly from U.S. businesses, to send phishing emails to county election employees. 

Both emails contained Microsoft Word document attachments regarding invoices, which redirected users to unidentified online credential-harvesting websites.  

The following day, cyber actors used an email address, purportedly from a U.S. business, to send a phishing email containing fake invoices to an election official. 

The emails contained an attached Microsoft Word document titled, “Current Invoice and Payments for report.” 

“The FBI judges cyber actors will likely continue or increase their targeting of U.S. election officials with phishing campaigns in the lead-up to the 2022 U.S. midterm elections,” the notification says. 

“Proactive monitoring of election infrastructure (including official email accounts) and communication between FBI and its state, local, territorial and tribal partners about this type of activity will provide opportunities to mitigate instances of credential harvesting and compromise, identify potential targets and information sought by threat actors and identify threat actors,” it says.

The FBI is recommending that network defenders take a number of steps to reduce the risk of compromise.

These include educating employees on how to identify phishing, spear-phishing, social engineering and spoofing attempts. The agency also recommends advising employees to be cautious when providing sensitive information — such as login credentials — electronically or over the phone, particularly if unsolicited or anomalous.

“Employees should confirm, if possible, requests for sensitive information through secondary channels,” the notification says.

According to the FBI, elections and other government offices should create protocols for employees to send suspicious emails to IT departments for confirmation.  

They should also:

• Mark external emails with a banner denoting the email is from an external source to assist users in detecting spoofed emails.  
• Enable strong spam filters to prevent phishing emails from reaching end users. Filter emails containing executable files from reaching end users.
• Advise training personnel not to open email attachments from senders they do not recognize.
• Require all accounts with password logins (e.g., service accounts, admin accounts and domain admin accounts) to have strong, unique passphrases. 
• Passphrases should not be reused across multiple accounts or stored on the system where an adversary may have access. (Note: Devices with local administrative accounts should implement a password policy that requires strong, unique passwords for each administrative account.)  
• Require multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks and accounts that access critical systems. 
• If there is evidence of system or network compromise, implement mandatory passphrase changes for all affected accounts. 

The FBI also recommends keeping all operating systems and software up to date. 

“Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats,” the notification says.

Dan can be reached at [email protected] and at https://twitter.com/DanMcCue