Whenever there is a major cyber incident, like the attack on Donald Trump’s campaign, there are many questions on everyone’s mind including:
Was this preventable?
Will it happen again and could it happen to my campaign?
What might happen next?
What should my campaign do right now?
Was this preventable?
It's likely, but we are not sure without more details.
We don't know all the specifics, so it's difficult to determine if this attack was entirely preventable. The hackers employed a classic approach: compromising someone close to and trusted by the campaign, then using their email to send seemingly legitimate messages to the intended targets. While the full extent of the attack's sophistication is still unclear, we do know that sensitive documents were stolen as a result.
The majority of spear phishing attacks can be prevented with the use of the strongest form of multifactor authentication available: a security key.
Security keys protect accounts even when login credentials are compromised or stolen in a phishing attack. Suppose someone tries logging into an account with only a password, or from a new machine, or other situations like a different country. In that case, the physical security key will be required before account access is granted. Eligible campaigns can get FREE security keys from DDC.
Will it happen again and could it happen to my campaign?
You can count on it.
In the world of cybersecurity, it's a fact that when one incident comes to light, it's rarely an isolated case. This principle holds true for the attack on the Trump campaign. Major tech companies like Google and Microsoft, which monitor and combat cyber threats, have reported a surge in phishing and spear phishing attempts targeting campaigns since June. We must assume that nation-states, hacktivists, and cybercriminals are constantly on the lookout for vulnerabilities, ready to exploit them at every opportunity.
What might happen next?
An environment of misinformation and phishing.
In addition to the actual threat of additional similar attacks, the bad actors may look to exploit the attack in other ways. Nefarious cyber actors have a long history of using and inserting themselves in news events to lure people to click and download things they shouldn’t. Everyone should be on the lookout for these social engineering efforts. Each hack is one step in their playbook.
For example, since the public is primed to be interested, it’s possible we could begin seeing fake news articles and news sites about alleged newly released confidential information from the Trump campaign or other campaigns. Such claims could appear in emails and news feeds on social media.
Your campaign could be swept in as well with impersonators claiming to be your candidate or campaign, or there could be inauthentic content allegedly stolen from your campaign released with the intention to harm you. Cybercriminals might attempt to contact your supporters claiming their personal information was lost in a hack of your campaign and urge them to click on a link to remedy the situation.
DDC can help and offers eligible campaigns two powerful tools: Doppel, which scans social media for impersonations and fake content, initiating takedown requests when necessary; and Valimail, which authenticates your outbound emails to prevent spoofing and impersonation of campaign communications.
What should a campaign do now?
Act now to protect your campaign. The risk will only increase between now and Election Day.
Don’t think your campaign is too small or unimportant enough to be a target. Even if you are running unopposed, bad actors might try to compromise your campaign or staff to reach other campaigns or steal personal information about donors, staff, or candidates.
Campaigns should ensure their core platforms (like Workspace or Microsoft 365) are configured correctly. Staff should be armed with security keys and remain vigilant about what’s coming into email boxes and newsfeeds. Campaign websites, a frequent target of cyber attacks, should be protected.
DDC can help campaigns be more cyber-secure with FREE products including:
Workspace for Campaigns: Account Security Fundamentals from Google and Microsoft Account Guard to better secure your platforms.
Cloudflare for Campaigns to protect websites
Doppel for protecting social media
Valimail for protecting outbound email
Security keys from Yubico and Google are the number #1 protection every campaign needs!
Get your core protections and common sense security measures in place to protect campaign and personal accounts, websites, social media, and email communications before Labor Day so you can finish off the campaign season with a little peace of mind.
DDC can help with all of this. Just reach out to info@defendcampaigns.org to get started.