Fortinet FortiGuard Labs Observes Darknet Activity Targeting the 2024 United States Presidential Election

Rhea-AI Summary

Fortinet's FortiGuard Labs has released a report highlighting cyberthreats targeting the 2024 U.S. Presidential Election. Key findings include:

• Phishing scams targeting voters with affordable kits sold on the darknet
• Over 1,000 new potentially malicious domains registered in 2024
• Billions of U.S. records for sale on darknet forums, including SSNs and PII
• 28% increase in ransomware attacks against U.S. government year-over-year

The report details the sale of phishing kits impersonating candidates, fraudulent fundraising websites, and the concentration of malicious domains on major hosting platforms. It also highlights the risks of credential-stuffing attacks, financial fraud, and identity theft. Fortinet emphasizes the need for vigilance, employee training, multi-factor authentication, endpoint protection, and regular software updates to safeguard against these threats.

Positive

• Fortinet's research provides valuable insights into cybersecurity threats related to the 2024 U.S. Presidential Election
• The report offers recommendations for preventing and mitigating cyberattacks during the election season

Negative

• 28% increase in ransomware attacks against U.S. government year-over-year
• Over 1,000 new potentially malicious domains registered since the beginning of 2024
• Billions of U.S. records, including SSNs and PII, are for sale on darknet forums
• Phishing kits impersonating presidential candidates are being sold on the darknet

Insights

Cybersecurity Analyst

The report highlights significant cybersecurity threats targeting the 2024 U.S. Presidential Election. Key concerns include:

• Affordable phishing kits ($1,260) impersonating candidates to harvest personal data
• Over 1,000 newly registered malicious domains related to the election
• Billions of U.S. records for sale on darknet forums, including SSNs and PII
• 28% increase in ransomware attacks against U.S. government year-over-year

These threats pose substantial risks to voter data, campaign integrity and public trust. The use of reputable hosting services like AWS and Cloudflare for malicious domains adds a layer of legitimacy to these attacks. Organizations and individuals must prioritize cybersecurity measures, including vigilant monitoring, employee training, multi-factor authentication and regular software updates to mitigate these risks effectively.

Political Analyst

The cybersecurity threats outlined in this report have significant implications for the 2024 U.S. Presidential Election. The sale of voter data and credentials on the darknet could lead to targeted misinformation campaigns and voter suppression efforts. The 28% increase in ransomware attacks against government entities is particularly concerning, as it could disrupt election infrastructure and erode public confidence in the electoral process.

The proliferation of fake fundraising websites and phishing scams targeting donors could impact campaign financing and potentially skew the playing field. Moreover, the availability of vast amounts of personal data on the darknet increases the risk of identity theft and fraudulent voting. These cyber threats collectively pose a serious challenge to the integrity of the democratic process and highlight the critical need for robust cybersecurity measures at all levels of the election system.

Phishing scams aimed at voters, malicious domain registrations impersonating candidates, and other threat activity designed to exploit unassuming victims take center stage as the U.S. election approaches

SUNNYVALE, Calif., Oct. 15, 2024 (GLOBE NEWSWIRE) --

Derek Manky, Chief Security Strategist and VP of Global Threat Intelligence at Fortinet
“As the 2024 U.S. presidential election approaches, it’s critical to recognize and understand the cyberthreats that may impact the integrity and trustworthiness of the election process and the welfare of the participating citizens. Cyber adversaries, including state-sponsored actors and hacktivist groups, are increasingly active leading up to major events like elections. Remaining vigilant and identifying and analyzing potential cyberthreats and vulnerabilities is crucial for preparing and safeguarding against the lures and targeted cyberattacks that could take advantage of a heightened moment in time and even disrupt or influence electoral outcomes.”

News Summary
Fortinet^® (NASDAQ: FTNT), the global cybersecurity leader driving the convergence of networking and security, today released its FortiGuard Labs Threat Intelligence Report: Threat Actors Targeting the 2024 U.S. Presidential Election, which reveals and analyzes threats tied to U.S.-based entities, voters, and the electoral process. Key findings from the threat intelligence report include:

• Phishing Scams Targeting Voters Leading Up to the 2024 U.S. Presidential Election: Threat actors are selling affordable phishing kits on the darknet designed to target voters and donors by impersonating the presidential candidates and their campaigns.
• Malicious Domain Registrations on the Rise: More than 1,000 new potentially malicious domains have also been registered since the beginning of 2024 that follow particular patterns and incorporate election-related content and candidates, suggesting that threat actors are leveraging the heightened interest surrounding the election to lure unsuspecting targets and potentially conduct malicious activities.
• Darknet Landscape: Billions of records from the U.S. are for sale on darknet forums, including Social Security numbers (SSNs), personally identifiable information (PII), and credentials that could be used in misinformation campaigns and lead to fraudulent activity, phishing scams, and account takeover; approximately 3% of the posts on darknet forums involve databases related to business and government entities.
• Ransomware Landscape: FortiGuard Labs researchers noted a 28% increase in ransomware attacks against the U.S. government year-over-year based on observed leak sites.

Scams Targeting the U.S. 2024 Presidential Election Flood the Darknet
Cyber adversaries, including state-sponsored actors and hacktivist groups, are increasingly active in the lead-up to elections.

The FortiGuard Labs research team observed threat actors selling distinct phishing kits for $1,260 each, created to impersonate U.S. presidential candidates. These kits are designed to harvest personal information, including names, addresses, and credit card (donation) details.

Since January 2024, FortiGuard Labs researchers have also identified more than 1,000 newly registered domain names that incorporate election-related terms and references to prominent political figures. Fraudulent fundraising websites, including secure[.]actsblues[.]com, meant to imitate the legitimate site for ActBlue (secure[.]actblue[.]com), a nonprofit American fundraising platform and political action committee.

The top two most-used hosting providers for these election-themed websites are AMAZON-02 and CLOUDFLARENET. The reliance on major hosting platforms such as Amazon Web Services (AWS) and Cloudflare suggests that threat actors are leveraging these reputable services to enhance the legitimacy and resilience of their malicious domains.

A notable concentration of domains is associated with a limited number of IP addresses, indicating a centralized approach by threat actors to efficiently manage multiple malicious domains to execute large-scale cyber campaigns.

No Shortage of Personal Data Being Sold Aimed at the U.S.
FortiGuard Labs analysis continues to show a significant number of diverse databases available on darknet forums targeting the U.S., including SSNs, usernames, email addresses, passwords, credit card data, date of birth, and other PII that could be used to challenge the integrity of the 2024 U.S. election. Specific highlights include:

• Over 1.3 billion rows of combo lists, which include usernames, email addresses, and passwords, signify a considerable risk for credential-stuffing attacks. In such attacks, cybercriminals use these stolen credentials to gain unauthorized access to accounts, making it a valid and substantial security concern.
• The discovery of 300,000 rows of credit card data, which include CVV, name, card number, expiration date, and date of birth, highlights potential financial fraud risks targeting voters and election officials.
• Over 2 billion rows of user databases on the darknet indicate a heightened exposure to identity theft and targeted phishing attacks.
• 10% of the posts on darknet forums are associated with SSN databases, which poses a significant threat by increasing the risk of personal data breaches.

The U.S. Government Is an Increasingly Attractive Target
Ransomware attacks targeting government agencies before an election can impact the electoral process and public trust in government institutions. Compared to 2023, the FortiGuard Labs research team observed a 28% spike in ransomware attacks against the U.S. government in 2024.

The darknet has become a hub for U.S.-specific threats, where malicious actors trade sensitive information and can potentially develop strategies to exploit vulnerabilities. Approximately 3% of the posts on these forums involve databases related to business and government entities. These databases hold critical organizational data that is vulnerable to cyber exploits and are a prime target for threat actors as the elections come and go.

Recommendations to Prevent and Mitigate Cyberattacks this Election Season
Cybersecurity measures are critical to safeguard the integrity of the U.S. 2024 presidential election. Following fundamental best practices can help prevent and mitigate the effects of cyber incidents. The full list of recommendations and best practices can be found in the report, but some key takeaways for citizens, business leaders, and election officials include:

• Always remain vigilant for suspicious behavior or activity leading up to major events and prioritize good cyber hygiene.
• Prioritize employee training and awareness.
• Enforce multi-factor authentication and a strong-password policy.
• Install endpoint protection solutions.
• Patch operating systems and web servers and update software regularly.
  

About the Fortinet FortiGuard Labs Election Security Report

• This report provides an in-depth analysis of threats observed from January 2024 to August 2024. It examines the diverse array of cyberthreats that may affect U.S.-based entities and the electoral process.
  

Additional Resources

• Read the full FortiGuard Labs Threat Intelligence Report: Threat Actors Targeting 2024 U.S. Presidential Election.
• Learn about FortiRecon and generating reports like this for your organization.
• Learn about FortiGuard Labs threat intelligence and research and outbreak alerts, which provide timely steps to mitigate breaking cybersecurity attacks.
• Learn about Fortinet's commitment to product security and integrity, including its responsible product development, vulnerability disclosure approach, and policies.
• Follow Fortinet on X, LinkedIn, Facebook, and Instagram. Subscribe to Fortinet on our blog or YouTube.
  

About Fortinet
Fortinet (NASDAQ: FTNT) is a driving force in the evolution of cybersecurity and the convergence of networking and security. Our mission is to secure people, devices, and data everywhere, and today we deliver cybersecurity everywhere you need it with the largest integrated portfolio of over 50 enterprise-grade products. Well over half a million customers trust Fortinet's solutions, which are among the most deployed, most patented, and most validated in the industry. The Fortinet Training Institute, one of the largest and broadest training programs in the industry, is dedicated to making cybersecurity training and new career opportunities available to everyone. Collaboration with esteemed organizations from both the public and private sectors, including CERTs, government entities, and academia, is a fundamental aspect of Fortinet’s commitment to enhance cyber resilience globally. FortiGuard Labs, Fortinet’s elite threat intelligence and research organization, develops and utilizes leading-edge machine learning and AI technologies to provide customers with timely and consistently top-rated protection and actionable threat intelligence. Learn more at https://www.fortinet.com, the Fortinet Blog, and FortiGuard Labs.

Copyright © 2024 Fortinet, Inc. All rights reserved. The symbols ® and ™ denote respectively federally registered trademarks and common law trademarks of Fortinet, Inc., its subsidiaries and affiliates. Fortinet’s trademarks include, but are not limited to, the following: Fortinet, the Fortinet logo, FortiGate, FortiOS, FortiGuard, FortiCare, FortiAnalyzer, FortiManager, FortiASIC, FortiClient, FortiCloud, FortiMail, FortiSandbox, FortiADC, FortiAI, FortiAIOps, FortiAntenna, FortiAP, FortiAPCam, FortiAuthenticator, FortiCache, FortiCall, FortiCam, FortiCamera, FortiCarrier, FortiCASB, FortiCentral, FortiConnect, FortiController, FortiConverter, FortiCWP, FortiDB, FortiDDoS, FortiDeceptor, FortiDeploy, FortiDevSec, FortiEdge, FortiEDR, FortiExplorer, FortiExtender, FortiFirewall, FortiFone, FortiGSLB, FortiHypervisor, FortiInsight, FortiIsolator, FortiLAN, FortiLink, FortiMoM, FortiMonitor, FortiNAC, FortiNDR, FortiPenTest, FortiPhish, FortiPlanner, FortiPolicy, FortiPortal, FortiPresence, FortiProxy, FortiRecon, FortiRecorder, FortiSASE, FortiSDNConnector, FortiSIEM, FortiSMS, FortiSOAR, FortiSwitch, FortiTester, FortiToken, FortiTrust, FortiVoice, FortiWAN, FortiWeb, FortiWiFi, FortiWLC, FortiWLM and FortiXDR. Other trademarks belong to their respective owners. Fortinet has not independently verified statements or certifications herein attributed to third parties and Fortinet does not independently endorse such statements. Notwithstanding anything to the contrary herein, nothing herein constitutes a warranty, guarantee, contract, binding specification or other binding commitment by Fortinet or any indication of intent related to a binding commitment, and performance and other specification information herein may be unique to certain environments.

Media Contact: Travis Anderson Fortinet, Inc. 408-235-7700 pr@fortinet.com

Investor Contact: Aaron Ovadia Fortinet, Inc. 408-235-7700 investors@fortinet.com

Analyst Contact: Brian Greenberg Fortinet, Inc. 408-235-7700 analystrelations@fortinet.com

FAQ

What cyberthreats are targeting the 2024 U.S. Presidential Election according to Fortinet (FTNT)?

According to Fortinet's report, the main cyberthreats include phishing scams targeting voters, malicious domain registrations impersonating candidates, sale of U.S. personal data on darknet forums, and increased ransomware attacks against the U.S. government.

How many new potentially malicious domains related to the 2024 U.S. election has Fortinet (FTNT) identified?

Fortinet's FortiGuard Labs has identified more than 1,000 new potentially malicious domains registered since the beginning of 2024 that incorporate election-related terms and references to prominent political figures.

What percentage increase in ransomware attacks against the U.S. government has Fortinet (FTNT) observed?

Fortinet's FortiGuard Labs researchers noted a 28% increase in ransomware attacks against the U.S. government year-over-year based on observed leak sites.

What recommendations does Fortinet (FTNT) provide to prevent cyberattacks during the 2024 U.S. election season?

Fortinet recommends remaining vigilant, prioritizing employee training and awareness, enforcing multi-factor authentication, installing endpoint protection solutions, and regularly updating software and patching systems.