Russia suspected of Macron hack

It said Pawn Storm set up four fake websites designed to steal email passwords from people in Macron’s political movement, En Marche! (Marching forward!).

It also detailed Pawn Storm’s attempt to hack the Konrad-Adenauer Stiftung, a German foundation linked to chancellor Angela Merkel.

Pawn Storm, which is sometimes called Fancy Bear, APT28, or Sednit, was previously responsible for hacking Democratic Party emails in the US election, for attacking Merkel’s CDU party, and the French broadcaster TV5 Monde, Trend Micro said.

Guillaume Poupard, the head of Anssi, France’s digital security service, told the Reuters news agency on Monday that it was too early to name Russia as the culprit.

Trend Micro also declined to name Russia, but the firm’s Feike Hacquebord told Reuters: “We have seen that phishing [fake] sites were set up and that the fingerprints were really the same ... as in the DNC [Democratic Party] breach”.

US intelligence services last year said the Pawn Storm group was a GRU front and that the US election hack was personally ordered by Russian president Vladimir Putin.

Fire Eye, a US cyber consultancy, in January also fingerprinted Russia in the TV5 Monde hack.

Mounir Mahjoubi, who runs Macron’s digital operations, told the AP news agency on Monday that it was fair to “suppose” Russian involvement due to the timing of the attack - in the middle of the French presidential campaign.

He described it as the “invisible” side of Russia’s anti-Macron operation, alongside overt attacks by Russian state media.

He said Pawn Storm’s fake websites were “pixel perfect … That means there was talent behind it and time went into it: talent, money, experience, time, and will.”

He said “nothing was compromised”, however.

He noted that Anssi had given En Marche! the information that it needed to spot Pawn Storm attacks and that the French security agency got the information from the US election hack.

Macron beat Russia’s preferred candidate, the far-right Marine Le Pen, in the first round of the presidential election last Sunday.

They will hold a run-off on 7 May in a vote that could destabilise the EU in the event of a Le Pen victory.

News of the GRU-suspected attack on Macron comes amid an anti-Macron campaign by Russian-state media, including its French-language outlets RT France and Sputnik France.

Russian media have circulated unsubstantiated claims, for instance, that he had had a gay love affair, that he was an agent of US banks, and that he was financed by Saudi Arabia.

The content was propagated by Russian bots, or automated social media accounts, some of which posted material over 750 times a day.

The same media favoured Le Pen, whose party has borrowed at least €11 million from Russia and who met Putin in Moscow last month.

Dmitry Peskov, the Kremlin spokesman, brushed aside Trend Micro’s findings on Monday.

"What [hacking] groups? From where? Why Russia? This slightly reminds me of accusations from Washington, which have been left hanging in mid-air until now and do not do their authors any credit”, he told press in Moscow.

But Russian media this week continued to paint Macron in a negative light.

Russia's First Channel TV broadcaster described his victory banquet on Sunday as "bohemian", while saying that Le Pen was a “candidate of the people”.

Dmitry Kiselyov, a Russian TV anchor, said the French state was plotting to stop Le Pen from winning.

A leading Russian MP and a senator, Konstantin Kosachyov and Alexey Pushkov, also said on Facebook and Twitter that the EU had bullied French voters into picking Macron and that he was Merkel’s puppet.

A German translation of this article may be found here.