Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
Summary: On May 25, 2021, Volexity identified a phishing campaign targeting organizations in the United States and Europe, with emails purporting to come from USAID and carrying a link that delivered an ISO file containing a malicious LNK, a malicious DLL, and a decoy PDF referencing foreign threats to the 2020 US Federal Elections. Volexity assessed with moderate confidence that APT29 was responsible, citing consistent tactics and noting the LNK metadata had been scrubbed compared with the same MAC address seen in 2016 and 2018 LNKs.
What you should know: The campaign's files had low static detection rates on VirusTotal at the time of writing, which Volexity read as a sign the attacker was likely having some success breaching targets.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026