©2023 Mandiant

U.S. Ele ct ion Assist ance Commission (EAC) 

This briefing is intended for election officials and those supporting elections in their official capacity. If 

you do not meet this definition, please log off from the briefing at this time .

Q1 20 24 Brie fing

J ason At we ll

Program Manage r, St rat e gic Se rvice s

Blake Djavahe rian

Se nior Analyst , St rat e gic Int e llige nce & Gove rnme nt (SIG)

1
©2023 Mandiant

AGENDA

❑ Int rod uct ion

❑ Int e llige nce Me t hod ology

❑ The Thre at Land scape

❑ Ob se rve d Act ivit y

❑ St rat e gic Out look

❑ Discussion

2
©2023 Mandiant

Int roduct ion

3
©2023 Mandiant

Exe cut ive Summary

Cyber- e nable d t hre at act ors across a wide 

spe ct rum of int rinsic mot ivat ions and 

ge ographical origin cont inue t o t arge t U.S. 

e le ct ions infrast ruct ure wit h malicious 

ope rat ions de signe d t o influe nce , 

manipulat e , monit or, or disrupt e le ct ions, or 

e nable int e llige nce colle ct ion e ffort s. 

4
©2023 Mandiant

Int e llige nce Me t hodology

5
©2023 Mandiant

Informat ion Sourcing & Fide lit y 

Information Sources:

● Mandiant Engage me nts

● Information Sharing Partne rships

● Open-Source Re porting

● Advance d Re se arch Me thods

Indicators of Compromise (IoCs):

● Static obse rvable s, e .g. file s, ne twork artifacts, and 

commands strings

● Inve rse re lationship be twe e n e ase of acquisition and 

ongoing use fulne ss 

Behavioral Indicators:

● Attack patte rns providing bucke ts to standardize the 

way we communicate adve rsarial actions

● Alone provide limite d information, but in combination 

can give critical conte xt

● Much more difficult to ide ntify, analyse , and act on in 

comparison to static indicators

Source : http s://www.linke d in.com /p ulse /p yram id -p ain-how-make - attackers-life - hardermurray-pearce/

6
©2023 Mandiant

At t ack Life cycle

Conduct actions-onobje ctive s to disrupt, 

de stroy, or e xfiltrate 

data from acce ssible 

portions of the victim 

network. 

Use acquire d acce sse s 

to conduct discove ry 

on the victim ne twork, 

ite rate through file 

dire ctorie s and 

applications, and 

move through the 

network undetected. 

Employ additional 

te chnique s to incre ase 

administrative 

privile ge s within the 

ne twork to e nable 

further tasks, 

including pe rsiste nce -

re late d actions and 

binary e xe cution. 

Gain pe rsiste nce 

through malware 

de ployme nts, 

configuration 

change s, cre de ntial 

theft, or other 

me thods of re taining 

acce ss following the 

prior stage . 

Le ve rage initial acce ss 

ve ctors, including 

vulne rable public 

facing infrastructure 

and e mploye e s of 

inte re st for social 

e ngine e ring. 

De te rmine obje ctive s, 

e xplore targe ts of 

inte re st, pre pare and 

stage capabilitie s. 

MITRE ATT&CK: Re connaissance , Re source De ve lopme nt , Init ial Acce ss, Exe cut ion, Pe rsist e nce , Privile ge 

Escalat ion, De fe nse Evasion, Cre d e nt ial Acce ss, Discove ry, Lat e ral Move me nt , Colle ct ion, Command and Cont rol, 

Exfilt rat ion, Impact

7
©2023 Mandiant

The Thre at Landscape

8
©2023 Mandiant

20 24 U.S. Pre side nt ial Ele ct ions Cale ndar

This e le ction cale ndar include s date s for pre side ntial primary and caucus e ve nts, party conve ntions 

and pre side ntial de bate s. Purple indicate s both partie s are holding an e ve nt on that date .

Source : 270 towin

March 0 5: Supe r Tue sday

J une 0 4: Final Primarie s He ld

J uly 15 - 18: Re publican National Conve ntion

August 19 - 22: De mocratic National Conve ntion

Se pte mbe r 16: First Pre side ntial De bate

Se pte mbe r 25: Vice Pre side ntial De bate

Octobe r 1: Se cond Pre side ntial De bate 

Octobe r 0 9: Final Pre side ntial De bate

Nove mbe r 0 5: Ge ne ral Ele ction Day

De ce mbe r 17: Ele ctors Cast Vote s

9
©2023 Mandiant

Ide nt ifying Adve rsary Obje ct ive s 

● An ad ve rsary’s primary und e rlying 

mot ivat ions inform t arge t ing as we ll as t he 

manner and speed they conduct 

ope rat ions

● Thre e primary mot ivat ions:

○ Dire ct Ele ct ion Int e rfe re nce 

○ Int e llige nce Gat he ring / Monit oring

○ Informat ion Ope rat ions (IO) 

● Ind ivid ual ob je ct ive s are oft e n mult id ime nsional and can re fle ct amorphous, 

e volving, and /or ove rlapping ad ve rsary 

mot ivat ions 

10
©2023 Mandiant

Dist inguishing Targe t s wit hin t he Ele ct ions Ecosyst e m 

● Campaigns 

○ Ne ws Organizat ions

○ Polit ical Part ie s & Campaigns 

○ Social Me d ia Plat forms

○ PACs & Donor Groups 

● Ad minist rat ion 

○ Ele ct ion Commissions 

○ Ele ct oral Re gist re s

○ St at e & Local Officials 

● Systems 

○ Vot ing Machine s 

○ Soft ware & Hard ware Manufact ure rs

○ Ele ct ion Manage me nt Syst e ms 

11
©2023 Mandiant

A Dynamic Thre at Landscape

Unde rlying 

Mot ivat ions Drive 

De cision Making 

• Malicious act ivit y 

represents humans at a 

keyboard

• Act ivit y may be highly 

t ailore d t oward part icular 

se ct ors or individual 

organizat ions

• Unde rlying mot ivat ions 

range from de st ruct ion and 

disrupt ion t o informat ion 

theft, among others

Profe ssionalism, 

Structure, and 

Re sourcing

• At t acke rs may fle xibly 

calibrat e t he ir capabilit ie s 

de pe nding on t he t arge t 

• Thre at s may linge r 

care fully for mont hs or 

e ve n ye ars wit hin a 

network

• At t acke rs may pivot t he ir 

t act ics base d on findings 

from wit hin a vict im 

network

Pe rsist e nce in 

Pursuit of Se t 

Obje ct ive s 

• Re solut e obje ct ive s mot ivat e 

t hre at s t o cont inuously 

pursue t arge t s ove r t he long 

term

• Gre at e r familiarit y wit h a 

give n ne t work me ans a t hre at 

is more like ly t o ide nt ify and 

le ve rage addit ional acce ss 

vectors

• Pe rsist e nce me chanisms 

me an part ial e vict ion may not 

re sult in comple t e 

re me diat ion 12
©2023 Mandiant

The Spe ct rum of Cont e mporary IO Act ivit y 

Primary IO Objectives Observed During 2022 Midterm 

Elections:

● Wide n e xisting political divisions

● Targe t spe cific conte ste d race s 

● Promote spe culation of fore ign inte rfe re nce 

IO Strategies:

● Coordinate d inauthe ntic activity

● Hack- and-le ak ope rations 

● Production and publication of disinformation

● Claims of disruptive activity targe ting e le ction 

infrastructure

● Claims of activity targe ting the confide ntiality of 

e le ction data 

13
©2023 Mandiant

De fining t he Curre nt St at e of AI-Enable d TTPs 

Background:

● Current research and open-source reporting indicates that AI—in the form of LLM 

platforms—has assisted a number of threat actors to better inform their operations, 

craft lure content and malware payloads, interact with victims, and generate 

misleading photo and video content to mislead audiences. 

○ TL;DR: AI has become a substantial force multiplier, but not game-changing 

capability, for contemporary cyber threat groups, including those interested in 

gathering intelligence from or influencing U.S. elections. 

Example Definitions of Initially Observed Tactics: 

● LLM-informed reconnaissance

● LLM-enhanced scripting techniques

● LLM-aided development

● LLM-supported social engineering

● LLM-assisted vulnerability research

● LLM-optimized payload crafting

● LLM-enhanced anomaly detection evasion

● LLM-directed security feature bypass

● LLM-advised resource development

14
©2023 Mandiant

Obse rve d Act ivit y

15
©2023 Mandiant

Ke y Take aways:

● Mandiant continue s to anticipate e spionage -base d inte llige nce colle ction and e nable me nt 

e fforts targe ting e le ction-re late d e ntitie s in 20 24:

○ The time -se nsitive nature of any such ope ration, the fle e ting inte llige nce value of most 

colle cte d information, and difficultie s taking action on most such information may hold 

many thre at actors from conducting e le ction-spe cific ope rations; howe ve r: 

■ Pre side ntial campaigns, auxiliary party me mbe rs and le ade rship, and othe r 

e le ction-re late d e ntitie s pose highly valuable targe ts for inte llige nce colle ction 

activitie s looking to gle an information on future U.S. policy, fore ign and dome stic. 

■ Controve rsie s surrounding curre nt pre side ntial candidate s—including he alth, 

pe rsonal and profe ssional re lationships, and busine ss de alings—highlight the 

amplifie d risks of pe rsonal data le aks and the ince ntive s thre at actors have to

pursue them. 

● Thre at actors from around the world continue to conduct Information Ope rations (IO) to fome nt 

disconte nt, misle ad We ste rn audie nce s, and othe rwise share and amplify information in ways 

me ant to influe nce and de grade the conduct and outcome s of U.S. and fore ign e le ctions. 

○ Russia, Iran, and PRC- aligne d IO campaigns continue to constitute the gre ate st volume of 

such activity, le ve raging social me dia ne tworks, hacktivist fronts, and othe r me ans to 

share and amplify information to We ste rn audie nce s. 

● Hacktivist fronts and ransomware thre at actors continue to pose a se rious disruptive thre at to 

e le ctions, whe the r e xplicitly de signe d to or not. 

○ Hacktivist fronts carry out fre que nt de nial-of-se rvice attacks alongside nationalistic, 

anti-We st rhe toric, and have de monstrate d prior activity paralle l to e le ctions. 

○ Ransomware attacks against gove rnme nt infrastructure time d (whe the r purpose fully or 

not) to coincide with e le ctions may paralyze the ir conduct and force substantial de lays. 

16
©2023 Mandiant

IO Campaigns, Impact s, and FUD 

Background: ● Fore ign state s continue to de ploy information ope rations 

(IO) to atte mpt to influe nce the conduct and outcome of 

e le ctions globally. 

Observations: ● Not all IO campaigns are cre ate d e qually, and most fall 

short ○ Obvious script

-following/bot use , poor language 

skills, lack of cultural aware ne ss 

● Succe ssful campaigns ofte n le ve rage curre nt e ve nts by 

calling into que stion official narrative s or providing 

alte rnative facts that are not e asily ve rifiable or that 

provide an e asy, malicious e xplanation for an othe rwise 

nuance d, se nsitive topic. ○ Campaigns may make varie d and cre ative use of 

various ve hicle s for information transfe r, including 

pote ntial physical ope rations (Se e Figure s). 

○ Audie nce s pre se nte d with multiple narrative s may 

be come fatigue d by choice and trust none , 

gravitate toward those most se nsational, or trust 

the first source the y e ncounte r rathe r than the 

most re putable . 

He adline Source s: 

https://www.france 24.com/e n/france /20 240 223-

france- blame s-russia-s-fsb-for- anti-se mitic-star- of-

david- graffiti- across- paris

https://www.politico.e u/article /france- condemns-

russia-involve me nt-stars- of- david- graffiti/

https://www.nytime s.com/20 24/0 1/0 9/busine ss/me dia/

e le ction- disinformation- 20 24.html

17
©2023 Mandiant

Russia-Aligne d Campaigns 

Mandiant has re ce ntly highlighte d continue d obse rvations surrounding thre at activity we 

attribute to "Ne wsroom for Ame rican and Europe an Base d Citize ns'' (NAEBC), a pro-Russia 

influe nce campaign alle ge dly run by individuals associate d with Russia's Inte rne t Re se arch 

Age ncy (IRA). Activity attribute d to NAEBC, which has pe riodically fluctuate d be twe e n ke y 

e ve nts such as U.S. e le ctions, has marke dly pe rsiste d de spite re pe ate d public e xposure and 

has continue d to targe t spe cifically right-le aning U.S. audie nce s on a range of issue s. 

Additionally, we note that cove rt asse ts within the pro-Russia propaganda and 

disinformation e cosyste m, including those that have be e n attribute d to Russian inte llige nce 

se rvice s, continue to amplify pro-Russia me ssaging targe ting U.S. audie nce s in the run-up 

to the 20 24 U.S. pre side ntial e le ction. For e xample , we continue to obse rve we ll-known 

disinformation site s such as "Ne wsFront" and "Southfront" incre asingly incorporate spe cific 

me ssaging surrounding the se upcoming e le ctions; conte nt publishe d to the se site s is ofte n 

furthe r amplifie d by both inauthe ntic and ge nuine source s, the latte r of which incre ase s the 

ability of the se campaigns to bre akout and re ach large r audie nce s. 

Similar to obse rve d thre at activity targe ting the U.S. 20 22 midte rm e le ctions, we e xpe ct 

both pre - e xisting and possibly ne wly e me rge d hacktivist pe rsonas to e ngage in pote ntially 

wide -ranging thre at activity targe ting the U.S. 20 24 e le ctions, including both disruptive and 

conve ntional information ope rations.

18
©2023 Mandiant

Iran-Aligne d Campaigns 

We note an e stablishe d pre ce de nt for Iranaligne d information ope rations activity 

targe ting U.S. audie nce s; notable campaigns 

have le ve rage d suspe cte d inauthe ntic ne ws 

site s, impe rsonate d U.S.- base d individuals, 

and in some case s, U.S. political candidate s. 

19
©2023 Mandiant

PRC-Aligne d Campaigns 

Throughout 20 23, pro-PRC IO activity e xhibite d a patte rn of 

aggre ssive ne ss manife ste d primarily in atte mpts to targe t 

e le ctions in the U.S., as we ll as e le ctions in Taiwan, and Hong 

Kong, including with activity flagrantly atte mpting to e ngage 

with vote rs and influe nce the ir e le ctoral choice s. 

We continue to obse rve conce rte d, and in some case s ongoing, 

e fforts attribute d to the pro-PRC campaigns 

"DRAGONBRIDGE" and "HaiEne rgy" to targe t U.S. dome stic 

political discourse . Obse rvations surrounding thre at activity 

attribute d to the se groups include past conce rte d e fforts 

targe ting the U.S. 20 22 midte rm e le ctions as we ll as re ce nt 

activity focuse d on the U.S. 20 24 e le ction cycle .

20
©2023 Mandiant

IO Surrounding Taiwan’s Pre side nt ial Ele ct ions 

Pro-PRC DRAGONBRIDGE Campaign Promote s Conte nt Pe rtaining 

to 20 24 Taiwan Pre side ntial Ele ction, Atte mpts to Discourage 

Taiwane se from Voting for the De mocratic Progre ssive Party

● Mandiant asse sse s with high confide nce that social me dia 

accounts we judge to comprise part of the pro-Pe ople 's 

Re public of China (PRC) DRAGONBRIDGE information 

ope rations campaign promote d conte nt pe rtaining to the 

20 24 Taiwan pre side ntial e le ction on multiple platforms, 

including conte nt atte mpting to discourage Taiwane se 

from voting for the ruling De mocratic Progre ssive Party 

(DPP).

○ Narrative s promote d by this activity se t ne gative ly 

portraye d the DPP and its pre side ntial candidate Lai 

Ching-te , de scribing the DPP and its me mbe rs as 

vote -se e king, ine ffe ctive , corrupt, and unfit for 

le ade rship. 

○ The promote d narrative s also aime d to portray 

Taiwan and its pe ople as e xpe rie ncing e conomic 

woe s unde r DPP's le ade rship. The se narrative s 

sugge ste d that if Lai and the DPP we re to be e le cte d, 

the situation would worse n for Taiwan and its 

citize ns.

21
©2023 Mandiant

Not ab le Russia-, Iran-, and PRC-Aligne d Campaigns Targe t ing U.S. 

Aud ie nce s

22
©2023 Mandiant

Und e rst and ing Hyb rid Ope rat ions

23
©2023 Mandiant

Espionage Targe t ing Europe an Polit ical Groups in Q1 

In late Fe bruary 20 24, a Russia- ne xus cluste r of activity that has 

pre viously targe te d diplomacy-re late d e ntitie s conducte d a phishing 

campaign like ly ce nte re d around Ge rman political partie s and the ir 

affiliate s: 

● Phishing e mails we re se nt to victims using an invite to a dinne r 

re ce ption be aring a logo from the Christian De mocratic Union 

(CDU), a political party in Ge rmany. 

● The campaign re pre se nte d a de parture from the group’s typical 

re mit of targe ting fore ign e mbassie s around the world, 

de monstrating the e volving nature of ge opolitically motivate d 

inte llige nce colle ction re quire me nts.

● The Ge rman-language lure docume nt contains a link dire cting the 

victims to a ZIP file containing a custom droppe r hoste d on an 

actor- controlle d compromise d we bsite .

● The droppe r de live re d a se cond -stage CDU-the me d lure docume nt 

and a custom next-stage payload re trie ve d from the same 

compromise d domain. 

24
©2023 Mandiant

Int e rre lat ions be t we e n Chine se Capabilit ie s, Post uring, and 

Ele ct ion-Spe cific Targe t ing

Observed Activity:

● Phishing campaigns le ve raging Taiwane se pre side ntial 

e le ction-the me d lure s to de live r malware . 

● Targe ting of the e ne rgy, te le communications, and 

gove rnme nt se ctors with tools that are share d to a limite d 

de gre e among China-linke d thre at actors to include 

POISONPLUG and SOGU malware . 

● Comme rcially available tools including Cobalt Strike 

BEACON have be e n use d to targe t Taiwane se e ntitie s in 

phishing campaigns. 

● Tange ntial impact has also be e n obse rve d in 20 23 and into 

20 24 as thre at actors le ve rage ze ro days that targe te d 

e dge de vice s and se curity appliance s.

Analysis: 

● Ongoing inte llige nce inte re st in the candidate s, support 

organizations, and othe r inte re ste d partie s surrounding 

e le ctions in are as of inte re st

○ Espe cially amplifie d by the pe rce ive d close ne ss of 

an e le ction as conte ntious as that of J anuary 13

● Various capabilitie s—including initial acce ss te chnique s, 

e nable me nt pre parations, tooling, and obfuscation 

efforts—are inte rope rable and fungible across a range of 

core state -ne xus obje ctive s. 

25
©2023 Mandiant

Supe r Tue sday 

Background:

● On 0 5 March, ove r a doze n state s he ld primarie s or caucuse s to 

choose the ir re spe ctive party candidate s.

● Mandiant obse rve d at le ast one e ve nt paralle l to, but not 

ne ce ssarily re late d to, the day of e le ctions:

○ Throughout the day, a te chnical issue at Me ta le d to a social 

me dia outage pre ve nting use rs from acce ssing the ir 

Face book and Instagram accounts. 

○ The hacktivist front Anonymous Sudan—which supports proRussia narrative s, amplifie s storyline s opposing the We st in 

ge ne ral, and ofte n claims DDoS attacks against We ste rn 

e ntitie s—quickly claime d re sponsibility alongside affiliate d 

threat actors Skynet and Godzilla. 

Takeaways:

● Eve n disruptive e ve nts with no substantive re lation to (or that are 

de monstrably unre late d to) the conduct of an e le ction can have 

the narrative hijacke d by opportunistic thre at actors. 

○ Thre at actors se e king to disrupt re al-world e ve nts do not 

always ne e d to e ve n de ploy capabilitie s to do so.

○ Hacktivist fronts (as we ll as e xtortionary cybe rcriminals) 

continue to be ne fit the most from the rapid publicity 

malicious claims ofte n re ce ive .

Above : Sp e culation re gard ing the source of Sup e r Tue sd ay’s 

social m e d ia outage , as we ll as com m e ntary on p ub lic 

re actions.

Below : Prior claim s b y Anonym ous Sud an targe ting We ste rn 

m e d ia outle ts in state d sup p ort for Gaza, re fle cting the ir 

ongoing cond uct of activity d ire ctly p aralle l to U.S. d om e stic 

as we ll as glob al p olitical issue s.

26
©2023 Mandiant

St rat e gic Out look

27
©2023 Mandiant

Threat Commonalities

“Traditional” Cyber Threats

● Generic phishing and spear- phishing continue to provide indispensable initial access vectors for threat actors

● A “campaign” still requires a mix of skills and capabilities

● Non- election specific issues such as ransomware can quickly play a role in public confidence, integrity, and availability

○ Activity doesn’t have to directly target elections to impact them, either immediately or down the line 

● Supply chains are the new front line (“edge” devices are emerging as critical)

Cognitive Domain Effects

● Perception of the attack and its consequences

● There is no nuance in the media

● The future isn’t now, but some may think it is (AI, deepfakes, etc.)

28
©2023 Mandiant

Identification of Key Terrain

Placing Re source s Whe re The y Do t he Most Good

Domains to Address:

● Trad it ional Ne t work De fe nse s

● Le ad e rship Ed ucat ion

● Privat e Se ct or Part ne rships

● Dat a Re silie nce and Re d und ancy

○ COOP Planning

● Ad ve rsarial Int e llige nce

○ Priorit ize d re quire me nt s

29
©2023 Mandiant

Hardening and Resilience Considerations

Cyber:

➔ Hunt ing

➔ Exe rcise s

➔ Thre at int e l for t he masse s

Cyber -Cognitive:

➔ “Two- pe rson” int e grit y

➔ Wargaming d e cisions 

Cyber -Physical:

➔ Whe re d oe s t he IT work happe n?

30
©2023 Mandiant

Discussion & Que st ions

EAC Cont act Form:

ht t ps://www.e ac.gov/cont act use ac

EAC Cont act Email:

cle aringhouse @e ac.gov

31
©2023 Mandiant

Thank you

32