Group says Russia hand found in French hopeful's hack

French centrist presidential candidate Emmanuel Macron attends a ceremony for slain police officer Xavier Jugele, in the courtyard of the Paris Police headquarters, Tuesday, April 25, 2017.
French centrist presidential candidate Emmanuel Macron attends a ceremony for slain police officer Xavier Jugele, in the courtyard of the Paris Police headquarters, Tuesday, April 25, 2017.

PARIS -- A security firm asserted Tuesday that a new cyberattack against the campaign offices of the front-runner in France's presidential race carried similar digital "fingerprints" to the suspected Russian hacking of the Democratic National Committee and others.

The report, released by the Trend Micro research group, did not disclose what possible fallout the infiltration had on the campaign of Emmanuel Macron, a centrist who is in a two-person runoff with far-right rival Marine Le Pen in the May 7 election.

But if a Russian connection was proved, the hacking would add to mounting allegations of Russia-backed attempts to influence Western elections in favor of candidates with policies potentially more favorable to the Kremlin. Le Pen has voiced opposition to the powers of the European Union and has called for better ties with Russia, echoing some of the campaign rhetoric of U.S. President Donald Trump.

Tokyo-based Trend Micro said Macron's campaign was targeted in March and April by a group called Pawn Storm. It is the same group that purportedly has used phishing and malware to infiltrate other political organizations, such as Angela Merkel's Christian Democratic Union party in Germany and the Democratic National Committee.

"There are several things which suggest that the group behind the Macron hacking was also responsible for the DNC breach, for example. We found similarities in the IP addresses and malware used in the attacks," said Rik Ferguson, the vice president of the company's security research program.

"We cannot say for sure whether this was directed by the Russian government but the group behind the attacks certainly appears to pursue Russian interests," added Ferguson, speaking from the company's London offices.

According to the research firm, the hackers created several email addresses on a fake server with the URL onedrive-en-marche.fr, operating from computers with IP addresses in multiple European nations including the United Kingdom.

The phishing attacks discovered by the Trend Micro group appear to be distinct from hacking allegations the Macron campaign itself made in February.

At the time, the campaign's secretary-general, Richard Ferrand, said its websites and networks were under constant attacks from hackers believed to be in Russia, and accused the Russian government of trying to influence the election.

The French government's cybersecurity agency ANSSI confirmed the more recently discovered cyberattacks against Macron, but stopped short of drawing connections to the earlier hacking. The agency left open the possibility that the recent attacks could be the work of "other high-level" hackers trying to point the blame at Pawn Storm.

The Macron campaign did not immediately respond to a request for comment. The Russian government has denied any connections to the hackings.

But some cyberespionage experts have previously linked the Pawn Storm group to Russia's intelligence services.

Le Pen has taken loans from Russian banks and has praised Russian President Vladimir Putin. Russian state media outlets have returned the favor by openly supporting the French candidate.

The final round of the election is considered also to be a referendum on the future of the European Union. A victory by Le Pen -- who is trailing Macron in polls -- could put in jeopardy France's participation in the euro common currency and give a major boost to factions seeking to copy Britain's EU exit.

"There is a crisis of confidence in France," said Cecile Vaissie, a Russia expert at the University of Rennes in northern France. "The Kremlin networks try to accentuate the doubts and divisions, and to propose the 'Russian model' as a solution. And these efforts will not end with the elections."

A Section on 04/26/2017

Upcoming Events