Reporters investigating Russian military intelligence have been targeted by extremely sophisticated cyberattacks by way of their encrypted e-mail accounts, with proof suggesting Moscow was accountable, the e-mail service provider ProtonMail and journalists mentioned on Saturday.
The phishing attack, which sought to dupe customers into sharing their ProtonMail passwords, was aimed at journalists from the award-winning web page Bellingcat, which helped determine the agents who poisoned former Russian spy Sergei Skripal in Britain.
Geneva-primarily based ProtonMail mentioned in a statement that “the proof (along with independent third-celebration assessments) look to recommend an attack of Russian origin.”
The company’s chief executive Andy Yen told AFP that the operation “was 1 if the ideal-run phishing attacks we have ever observed.”
Bellingcat journalist Christo Grozev, who led the site’s perform on the Skripal case, mentioned he had no doubt Russia’s GRU military intelligence unit was accountable and that it marked “a quantum leap” in terms of their technical sophistication.
“It was extremely convincing,” he told AFP, noting that no Bellingcat reporters gave up their passwords.
The Harvard-educated Yen, who worked at Europe’s nuclear investigation lab CERN for 5 years ahead of founding ProtonMail, told AFP that the enterprise could not study users’ emails even if it wanted to – in clear contrast with Google’s Gmail.
The phishing attacks against Bellingcat reporters occurred this week, with “emails sent to the targeted customers claiming to be from the ProtonMail group, asking the targets to enter their… login credentials,” the enterprise mentioned.
Grozev mentioned that in spite of his technical savvy and awareness that he was a target, he “would have been fooled” if not for prior warning from a speak to who had received a related phishing e-mail earlier this month.
Though the assault on Bellingcat journalists was concentrated more than the previous couple of days, Grozen claimed that many investigators and researchers from other organisations that perform on Russia have received phishing emails in their ProtonMail accounts considering the fact that April.
Yen told AFP that “placing a precise begin date as to when other Russia journalists started to be targeted is a bit extra complicated and not some thing that we can confirm with complete self-assurance ideal now.”
Yen mentioned that ProtonMail has alerted the Swiss Federal Police and the government’s personal computer method safety workplace, MELANI, about the events this week.
The enterprise has not but received any indication that an investigation will be launched, Yen mentioned, noting that he had tiny hope a Swiss government probe will be efficient.
ProtonMail is conducting its personal investigation.
But Grozen mentioned the Swiss had a duty to act, in portion simply because its .ch domain was utilised to carry out the phishing operation.
“It is basically a crime inside the digital territory of Switzerland,” he mentioned, stressing that the entities who registered the malicious .ch internet sites are “traceable for (Swiss) authorities”.
Swiss Federal Police and MELANI did not straight away respond to a request for comment.
Bellingcat, a extremely regarded Britain-primarily based investigative web page, has utilised open-supply technologies to break a series of stories, notably regarding Russia, like key revelations in the downing of MH17 flight more than eastern Ukraine, which has also been linked to Russia’s GRU intelligence service.
GET THE NEWS at your fingertips and download the News24 app for Android right here now. Get it for your iPhone right here.
Maintain UPDATED on the most current news by subscribing to our Free of charge newsletter.
– FOLLOW News24 on Twitter