Russian ‘Dukes’ of Hackers Pounce on Trump Win
Summary: Volexity reported that the Russian hacking group known as Cozy Bear, APT29, or The Dukes launched at least five waves of email-based malware phishing attacks against U.S. political think-tanks and NGOs within six hours of Donald Trump's acceptance speech. The lures posed as Clinton Foundation messages, eFax links, and documents about the election being rigged or flawed, using booby-trapped Office documents that prompt targets to enable macros.
Key Takeaway: Volexity CEO Steven Adair said the group's obfuscated macros 'will sail right through just about any [antivirus] tool, appliance or cloud service,' and that the malware checks for admin accounts and sandboxes before proceeding - so the controls most organizations rely on are not the ones that stop this.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026