VORANT. Threat Intelligence Sign in Get the full feed

Russia, China, Iran interfere in US 2024 election

routine threat government-national

Russia, China, and Iran conducted foreign interference campaigns in the 2024 US election via disinformation, hack-and-leak operations, and influence networks, with activity expected to continue through inauguration.

The Atlantic Council's Digital Forensic Research Lab documented coordinated foreign interference in the 2024 US election by Russia, China, Iran, and other adversaries. Russia conducted a $10 million influence operation targeting far-right media and operated the Doppelganger network spreading tens of thousands of false stories and staged videos across swing states (Pennsylvania, Georgia, Arizona), while launching fake bomb threats against polling places. China focused on down-ballot races using fake American personas and generative AI across 50+ platforms, targeting anti-China politicians. All adversaries aimed to erode faith in democratic institutions and heighten social division.

The interference surpassed the scale of 2016 and 2020 operations in volume and sophistication. Iran and China attempted cyber breaches of presidential campaigns in hack-and-leak operations. Unlike previous cycles, US government departments of Justice, Treasury, and State took proactive actions against Russian interference efforts in real time. However, experts predict foreign actors will continue amplifying debunked narratives post-election and may escalate to direct interference attempting to mobilize protests or violence during certificate-of-ascertainment submission (December 11), elector voting (December 17), and through inauguration (January 20).

Despite the high volume of foreign influence efforts observed, analysis indicates the campaigns have had limited measurable impact on American opinion or behavior to date. The reporting underscores the evolving nature of state-sponsored election interference and the persistent challenge of distinguishing foreign disinformation from domestically-originated false content.

Mentioned in this report

Campaigns Doppelganger

Detection guidance

Spearphishing Campaign with Attachment Delivery

ATT&CK T1566.001

Detects email clients or mail processing establishing suspicious attachment patterns characteristic of mass phishing campaigns targeting political/campaign infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Spearphishing Campaign with Attachment Delivery
description: Detects indicators of spearphishing emails with attachments delivered
  at scale. Observes email processing creating or executing attachments from temporary
  storage, typical of mass phishing campaigns against high-value targets like political
  campaigns.
tags:
- attack.initial-access
- attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \outlook.exe
    - \thunderbird.exe
    - \chrome.exe
    - \firefox.exe
    TargetFilename|contains:
    - \AppData\Local\Temp\
    - \Users\*\Downloads\
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .vbs
    - .ps1
    - .bat
  filter_software_updates:
    TargetFilename|contains:
    - Windows Update
    - Program Files
  condition: selection and not filter_software_updates
falsepositives:
- Legitimate email client downloads of attachments to temp folders
- Software auto-update mechanisms downloading executable patches
level: medium
id: c5cdbee6-59d6-5107-ac6b-f46f3881853c
status: experimental
author: Vorant

Screen Capture and Credential Harvesting Pattern

ATT&CK T1113

Detects process chains combining clipboard access, screen capture, and data staging typical of information-gathering operations against campaign systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Screen Capture and Credential Harvesting Pattern
description: Detects suspicious process spawning screen capture or clipboard utilities
  followed by file staging in temporary directories. Characteristic of data-gathering
  operations against political campaigns harvesting credentials or sensitive information.
tags:
- attack.collection
- attack.t1113
- attack.t1115
logsource:
  category: process_creation
  product: windows
detection:
  selection_capture:
    Image|endswith:
    - \SnagIt.exe
    - \ShareX.exe
    - \mspaint.exe
    - \screencapture.exe
    CommandLine|contains:
    - capture
    - screenshot
    - screen
  selection_clipboard:
    Image|endswith: \cmd.exe
    CommandLine|contains:
    - clip
    - clipboard
  selection_staging:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    CommandLine|contains:
    - \AppData\Local\Temp\
    - \Users\*\AppData\Local\Temp\
  condition: 1 of selection_*
falsepositives:
- Legitimate remote support tools using screen capture
- IT asset discovery scripts staging data for inventory
level: medium
id: af4e68d9-6c69-5d1c-a0aa-d44870400e8d
status: experimental
author: Vorant

Network Traffic Exfiltration Over Web Protocols

ATT&CK T1041

Detects suspicious outbound HTTP/HTTPS connections from non-web applications exfiltrating data to attacker-controlled infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Network Traffic Exfiltration Over Web Protocols
description: Detects non-browser processes establishing HTTP/HTTPS connections with
  POST requests and large data transfers, typical of malware and APT tools exfiltrating
  stolen campaign or political data over web protocols.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \svchost.exe
    - \rundll32.exe
    - \regsvcs.exe
    - \certutil.exe
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
    Protocol: tcp
  filter_windows_services:
    Image|endswith:
    - \svchost.exe
    DestinationHostname|contains:
    - microsoft.com
    - windows.com
    - live.com
  condition: selection and not filter_windows_services
falsepositives:
- Legitimate system services reaching Microsoft or Windows Update servers
- Enterprise proxy traffic from system processes
level: medium
id: 1dca68f6-1d1e-51d7-afb5-1e8590ddf39a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/fastthinking/what-to-know-about-foreign-meddling-in-the-us-election

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free