Honeypots and the French election

NOTE: this post is primarily a reprint of other sources. I credit them of course. I just wanted to get the information in one place for quick reference. The main points that cannot be reasonable disputed are:
- There was some sort of attack on the Macron presidential election campaign targeting email and documents.
- The tech savvy Macron folks had prepared in advance with a honeypot strategy that was at least partially effective
- Many indicators are Russian in nature with Fancy Bear/APT28 at the top of the list, however, Forbes was wise to bring attribution into question. I have worked on attribution in one manner or another for fifteen years and there is a real risk of drawing an incorrect conclusion.

An article published by Ars Technica describes the Russian attempt to influence the French presidential election. "The failed effort by Russian attackers to influence the outcome of the French presidential campaign in its final hours was in part a forced error, thanks to an active defense by the digital team of French president-elect Emmanuel Macron's campaign organization, the digital director of the campaign has claimed. Campaign team members told the New York Times that as the phishing attacks mounted, they created a collection of fake e-mail accounts seeded with false information.
"We created false accounts, with false content, as traps," Macron campaign digital director Mounir Mahjoubi told the Times. "We did this massively, to create the obligation for them to verify, to determine whether it was a real account."

In their haste, they left tailtale signs of their identity, "According to a Trend Micro report on April 25, the Macron campaign was targeted by the Pawn Storm threat group (also known as "Fancy Bear" or APT28) in a March 15 "phishing" campaign using the domain onedrive-en-marche.fr. The domain was registered by a "Johny Pinch" using a Mail.com webmail address. The same threat group's infrastructure and malware was found to be used in the breach of the Democratic National Committee in 2016, in the phishing attack targeting members of the presidential campaign of former Secretary of State Hillary Clinton, and in a number of other campaigns against political targets in the US and Germany over the past year."

Forbes, however cautions the evidence is not conclusive, "And, Doman told me, he had not seen "anything definitive" linking the two phishing domains found by Trend Micro and the Macron dump, "though it seemed likely."
Muddying the waters even further is the fact that En Marche's digital lead Mounir Mahjoubi indicated to French press Macron's campaign may have put its own fake data on its servers as part of a "honeypot," set up to attract hackers and trick them into pilfering tagged data. Typically, honeypots are used as traps to track attackers' activities."

Attribution is, and will always be, one of the most challenging problems of cybersecurity response. The folks that are willing to say "probably" as opposed to "surely" are to be congratulated.

This operation will certainly add credibility to Macron's emphasis on cybersecurity and tech for France and his efforts to combat extremism. "French presidential candidate and frontrunner Emmanuel Macron said on Monday he would step up efforts to get technology firms such as Google or Facebook to share encrypted content from messaging services with authorities."

"With an eye on the Elysée Palace, Mr Macron has been only too happy to associate himself with France’s burgeoning tech scene, hoping its open-mindedness and can-do attitude would reflect back on him. When he was economy minister he hastily organised a glitzy reception for him and French entrepreneurs at the Consumer Electronics Show in Las Vegas in 2016. Prosecutors are probing irregularities in the way the party was organised, although the investigation does not involve him.
As economy minister in a socialist government he enthusiastically backed a government initiative to promote the country’s tech ecosystem under a single brand at home and abroad. “Macron has been a strong advocate for the French tech scene,” says Frederic Mazzella, co-founder of ride-sharing company BlaBlaCar."