Threat Intelligence Report

Date: August 28, 2024

Prepared by: David Brunsdon, Threat Intelligence – Security Engineer, HYAS

As the US election approaches, the surge in political activity and heightened public interest make it an attractive target for cybercriminals. In each election cycle, billions of dollars are donated to support various candidates and political causes. For example, the 2020 US election saw an unprecedented amount of over $14 billion in donations, surpassing any previous election in US history. This enormous influx of funds creates opportunities for threat actors to exploit vulnerable donors and organizations.

One such tactic, which has been observed in the past and appears to be resurfacing, involves the creation of fake domains that closely mimic legitimate donation websites. In 2016, following the Democratic National Convention (DNC) hacks, Buzzfeed News reported that cybercriminals had set up fake domains to impersonate legitimate political websites, aiming to trick users into donating to fraudulent causes.

ActsBlue Phishing Site

Now, this tactic seems to be active again. The domain actsblue[.]com has been identified as a phishing site designed to look identical to actblue.com, the official platform for Democratic Party donations. Unlike the legitimate site actblue.com, which is registered with Amazon AWS, actsblue[.]com is registered with Namecheap, a registrar known for providing anonymity through redacted WHOIS data and accepting bitcoin payments. This anonymity makes it challenging to trace the domain back to the original threat actors, making it difficult to attribute it to the same group responsible for similar attacks in the past.

Look for Unlikely Account Names

One suspicious element of the phishing page is the large variety of payment options, some with unlikely account names:

Zelle Payment: diazjohana394@gmail[.]com

Cash App Payment: $MollyManisay

Venmo Payment: $JJWDiaz

Bitcoin Payment: bc1q856ynd25sf43suwcy4shlszdkkxk42ahlpe6ec

Ethereum Payment: 0xC8623b18327957751A2ffbEEdAd002319A52D367

USDT Ethereum (ERC20) Payment: 0xC8623b18327957751A2ffbEEdAd002319A52D367

For USDT Tron (TRC20) Payment: TGfoTqZLc3SNYkataG8pBf1vTvDf3Z62QK

A domain like this could be combined with phone calls, text messages, or emails to direct potential donors to the malicious site. This case underscores the importance of vigilance among donors and political organizations as the election draws near. Cybercriminals are likely to continue exploiting the chaotic and high-stakes environment to siphon funds and sow confusion.

Download: How to Stop Phishing Attacks with Protective DNS

Suspicious Domains Identified

In our investigation, we have identified a series of suspicious domains, all registered through domain.com and using the same nameservers: ns1.dotster.com and ns2.dotster.com. These domains include:

nationalcommittee[.]democrat
nationalcommittee[.]republican
republicanpac[.]net
democraticnationalcommittee[.]co
democratnationalcommittee[.]org
republicannationalcommittee[.]org

While some of these sites appear to accept donations, it is unclear where the funds are actually directed. The consistent configuration across these domains suggests they may have been registered by the same actor. We strongly advise against making donations through these sites until more information is available.

Warning: Be Cautious When Making Donations

As the election season heats up, it’s crucial to be vigilant about where you send your donations. Cybercriminals often take advantage of the heightened emotions and urgency surrounding elections to deceive well-meaning donors. If you receive a request for a donation via phone call, email, or text message, always verify the legitimacy of the source before proceeding. Do not click on links or provide payment information unless you are certain that the request is genuine.

For those wishing to support political campaigns, the official websites for donations are:
Republican Party: winred.com
Democratic Party: actblue.com

Donating through these sites ensures that your contributions are directed to the intended recipients.

Want more threat intel on a weekly basis?

Follow HYAS on LinkedIn
Follow HYAS on X

Read recent HYAS threat reports:

HYAS Investigates Threat Actors Hidden In Gaming Services

Caught in the Act: StealC, the Cyber Thief in C 

HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards

StealC & Vidar Malware Campaign Identified

Sign up for the (free!) HYAS Insight Intel Feed

Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report’s information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.

Learn More About HYAS Insight

An efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.

Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.

More from HYAS Labs

Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.

Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.

*** This is a Security Bloggers Network syndicated blog from HYAS Blog - 2024 authored by David Brunsdon. Read the original post at: https://www.hyas.com/blog/special-bulletin-us-election-phishing-alert