US presidential elections 2024 face three prong challenge from Iran, China and Russia in cyber world

Thousands of Americans turn to news sites like the Washington Post and Fox News to receive information and make decisions. However, many of them had no idea that the presumed news links of their favourite platform they interacted with were not genuine. They were carefully crafted “Doppelganger” pages mimicking the original media platforms.

These sites were one of the 32 internet domains seized by the United States Department of Justice (USDOJ) this week that, as per FBI, were linked to Russia.

According to the US authorities, these platforms were created to influence the upcoming 2024 presidential elections. The latest revelation is just a part of multiple influence operations recently identified, with other influence operations being attributed to foreign state-linked actors in China and Iran.

RUSSIAN OPERATION

The recently exposed Russian operation also used influencers and fake profiles to trick viewers into consuming disinformation across platforms like X (formerly Twitter), Facebook and 9GAG–a Hong Kong based social media platform. These campaigns relied on impersonated domains, AI-generated content, and paid social media ads to target US voters. Interestingly, one of the key narratives of the campaign included advocacy to reduce international support for Ukraine.

Earlier this year, DOJ also claimed to disrupt a Russian AI-enhanced bot farm designed to spread disinformation, including attempts to influence US elections. The operation involved the seizure of two domain names and the search of 968 social media accounts linked to Russia.

But these are not isolated incidents, various foreign threat actors from multiple nations have been actively increasing their attempts to interfere with the US presidential elections 2024.

CHINA’S ‘SPAMOUFLAGE’ NETWORK

Graphika, a US based network analysis firm report, shed light on the “Spamouflage” network, linked to Chinese actors manipulating public opinion on US elections. The network deployed inauthentic personas on social media, such as the long-standing account “Deep Red,” which rebranded itself as “Common fireman,” pretending to be an American user aligned with Chinese state interests.

Other accounts, like “Harlan Report,” used AI-generated avatars and shifted identities to promote both pro-Trump and anti-Biden narratives across platforms like TikTok and X.

IRANIAN THREAT ACTORS

Adding to these threats, Microsoft has also highlighted the involvement of Iranian cyber actors. Iranian hackers, particularly APT42, have targeted US elections through spear-phishing campaigns. These efforts often involve highly personalised attacks aimed at stealing sensitive information from key individuals involved in the electoral process.

The Iranian state actors, APT42 has been active in the 2024 elections, with the recent report from Google’s Threat Analysis Group revealing that US and Israel accounted for approximately 60 per cent of APT42’s known geographic targeting. Among their targets were former senior Israeli military officials and individuals affiliated with U.S. presidential campaigns.

Beyond phishing, Iranian cyber operations also involve ransomware attacks. In a threat intelligence report Microsoft stated about a malware named tickler, from Peach Sandstorm–Iranian backed ransomware group, which was designed to infiltrate government and defence sectors using password spray attacks and social engineering via LinkedIn. This allowed them to gain initial access to systems and carry out long-term surveillance operations.

Several Iranian-affiliated ransomware groups have been identified, including Pioneer Kitten, Fox Kitten, UNC757, Parisite, RUBIDIUM, and Lemon Sandstorm to launch even more devastating attacks.

AI IN DISINFORMATION

AI has become a powerful tool for malicious actors. In addition to Russia’s and China’s AI-driven campaigns, Iran has also used AI to amplify its propaganda. The Iranian network “International Union of Virtual Media” (IUVM) generated and spread false information across the US and Middle Eastern audiences. Fake news outlets like “Nio Thinker” and “Savannah Times” published misleading content that targeted US political figures, especially around contentious issues like LGBTQ+ rights.

Meta has also reported the growing threat while blocking WhatsApp accounts linked to Iranian hackers. These accounts were masquerading as tech support agents to steal sensitive information from US political figures. Additionally, Meta banned 96 Facebook accounts, 16 pages, 12 groups, and 3 Instagram accounts involved in spreading disinformation, many linked to the fictitious group “Patriots Run Project.”