Loading story…
The FBI and CISA warned that foreign actors and cybercriminals could use online journals, pseudo-academic websites, spoofed domains, fraudulent email accounts, and DDoS attacks to spread false election information and erode confidence in the 2020 U.S. election. The agencies said attackers were likely to amplify claims about voter suppression, ballot fraud, cyberattacks on election infrastructure, and other narratives designed to portray the election as illegitimate, while lookalike websites and emails could also be used to steal credentials, harvest personally identifiable information, and deliver malware.
U.S. officials said cyber threats to election infrastructure could cause localized delays or disrupt access to public-facing voting information, but were not assessed as capable of preventing voting or altering ballot integrity or vote tallies. They emphasized that safeguards such as provisional ballots, paper backups, backup pollbooks, and alternative communication channels limited the impact of incidents, while later reporting indicated Russia did not mount a major interference campaign on the scale of 2016, despite continued lower-level influence efforts and persistent concern that uncertainty around vote counting and result reporting could be exploited to fuel post-election confusion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
The FBI and CISA issued a joint warning that spoofed election-related internet domains and email accounts could be used by foreign actors and cybercriminals to spread false information, steal credentials and personal data, and deliver malware. The advisory urged voters to verify website and email spellings and rely on trusted sources for election information.
The FBI and CISA issued a public announcement warning that foreign-backed online journals, including pseudo-academic sites, could be used to spread misinformation and disinformation about the 2020 U.S. elections. The agencies said such narratives could include claims about voter suppression, cyberattacks, or ballot fraud intended to undermine confidence in the election.
The FBI and CISA warned that DDoS attacks against election-related public-facing websites could slow or disrupt access to voting information and unofficial results, but would not prevent eligible voters from casting ballots or compromise ballot integrity. They also cautioned that cyber actors could falsely claim such attacks affected voting systems.
The FBI and CISA issued a joint alert warning that false claims about hacked voter information or compromised election systems were likely intended to cast doubt on the legitimacy of U.S. elections. The agencies said they had no information that cyberattacks had prevented elections, altered voter registration accuracy, stopped registered voters from voting, or compromised ballot integrity.
The FBI and CISA announced that cyber threats to election infrastructure could cause temporary disruptions or delays but were not assessed as capable of preventing voting or changing vote tallies in the 2020 elections. They said observed attempts had been localized, blocked, minimal, or easily mitigated.
Several U.S. government agencies issued a warning that foreign entities could use disinformation to create confusion and discord around the 2020 U.S. election, including by manipulating communications about election activity and results. The warning emphasized that attackers might exploit delays and uncertainty without compromising election systems directly.
The U.S. intelligence community publicly assessed in August that Russia was using a range of measures primarily to denigrate Joe Biden and the anti-Russia establishment. William Evanina also publicly identified Andriy Derkach as spreading unfounded corruption claims about Joe Biden.
During Ukraine's 2014 presidential election, election authorities were reportedly disrupted and official election-result announcements were interdicted. The case was cited as an example of attackers targeting election communications rather than altering vote totals directly.
U.S. officials said Russia failed to mount any major hacking or disinformation operation against the 2020 U.S. presidential election at the scale seen in 2016, and Kremlin hackers did not significantly target election systems. Officials and analysts attributed this in part to Cyber Command and NSA actions, stronger election security, and Russia's own cost-benefit calculations.
The U.S. Treasury Department sanctioned Andriy Derkach and described him as an active Russian agent. The Washington Post reference cites this as part of the lower-level Russian influence activity seen during the 2020 election cycle.
8 references tracked. Mallory keeps watching after this page renders.
washingtonpost.com
Open sourceic3.gov
Open sourceic3.gov
Open sourceic3.gov
Open sourceic3.gov
Open sourceic3.gov
Open sourcepylos.co
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point warned that threat actors are already preparing to disrupt the 2026 U.S. midterm environment by targeting election-adjacent infrastructure rather than voting machines. The firm reported a surge in newly registered election-themed domains and exposed credentials tied to major political and government platforms including `ActBlue`, `WinRed`, `gop.com`, `democrats.org`, and `usa.gov`, creating opportunities for phishing, impersonation, fake donation pages, credential theft, and broader trust-eroding disruptions. Researchers identified Russia, Iran, and China as the principal state actors to watch, alongside risks from misinformation and foreign influence operations. The report said AI is likely to amplify these threats by helping adversaries scale convincing phishing lures, cloned audio, manipulated images, and deepfake videos during politically sensitive periods. It also highlighted local governments as a weak point because of aging technology, limited budgets, and small security teams, pointing to ransomware incidents in Winona County, Minnesota, and Foster City, California. The warning comes as officials debate the future of the federal election security posture, including a budget proposal that would eliminate CISA’s election security program and concerns about reduced preparedness ahead of the midterms.
Jun 29, 2026
US Cyber Command secretly targeted at least two Russian companies involved in covert online influence activity ahead of the 2024 US election, according to reporting that said the operation was part of a wider federal effort with the FBI, DHS, and other agencies to expose and disrupt foreign meddling aimed at voters in key swing states. The campaign reportedly pushed anti-Ukraine and anti-politician narratives, and officials said the US action slowed the Russian operation even though propaganda content continued through Election Day. The activity fits a longer pattern of Russian interference in US politics, following earlier US government findings that Moscow targeted election systems in 2016 and subsequent Justice Department charges against Russian individuals and companies tied to interference operations. Officials and former officials warn that many of the structures built after the 2016 election to counter foreign influence have since been dismantled, reduced, or paused, including functions at ODNI, the FBI, the State Department, and CISA. The rollback comes despite continued threats from Russian, Chinese, and Iranian-linked actors using fake websites, AI-enabled propaganda, and cyber activity affecting election infrastructure, raising concerns that the United States has less visibility and fewer coordinated defenses in place for future elections.
Jun 29, 2026
US Cyber Command and the NSA have repeatedly used covert cyber operations to blunt foreign election interference, including ejecting Iranian hackers from a municipal website used to post unofficial 2020 results before false information could be spread and disrupting Russian influence operators targeting voters ahead of the 2024 election. Officials said the 2020 intrusion did not affect voting, ballot tabulation, or certified results, and described the broader mission as a joint effort with CISA, the FBI, DHS, and other agencies to counter cyberattacks, troll farms, fake websites, and AI-enabled propaganda tied to Russia, Iran, China, North Korea, and non-state actors. At the same time, the US government has reduced parts of the election security apparatus built after 2016. Reporting says the Trump administration put CISA election security staff who worked with states on leave and dismantled or downsized programs across ODNI, the FBI, the State Department, and CISA that tracked and exposed foreign influence campaigns. Current and former officials warned that the cuts weaken coordination with state and local election officials, reduce visibility into ongoing threats, and leave the country less prepared for future elections even as harassment of election workers and concern over the safety of cyber personnel have pushed agencies to keep some leadership roles out of public view.
Jun 29, 2026