Appendix

How Cyber Propaganda

Influenced Politics in 2016
Appendix

TrendLabs Security Intelligence Blog

January 2017

Trend Micro | How Cyber Propaganda Influenced Politics in 2016

TREND MICRO LEGAL DISCLAIMER

The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice.
The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied
on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing herein should be construed otherwise.
Trend Micro reserves the right to modify the contents of this document at any time without prior notice.
Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise
related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in the
translation are not binding and have no legal effect for compliance or enforcement purposes.
Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any
kind as to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk.
Trend Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing, or delivering this document
shall be liable for any consequence, loss, or damage, including direct, indirect, special, consequential, loss of business profits, or special damages, whatsoever
arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof. Use of this
information constitutes acceptance for use in an as is condition.

Trend Micro | How Cyber Propaganda Influenced Politics in 2016

List of the targets

The following table lists entities and organizations we have observed to have been targeted by
Pawn Storm.
Date
12-Dec-13
15-May-14
23-Oct-14
25-Feb-15
25-Mar-15
26-Mar-15
13-May-15
04-Sep-15
05-Sep-15
16-Oct-15
19-Oct-15
21-Oct-15
04-Mar-16
23-Jan-14
11-Feb-14
04-Apr-14
30-Apr-14
22-May-14
18-Nov-14
05-Sep-15
19-Feb-16
17-Mar-15
16-Jul-15
02-Oct-15
02-Oct-15
10-Dec-15
10-Jan-14
24-Apr-14
24-Apr-14
11-Aug-14
10-Sep-14
01-Nov-14
01-Dec-14

Organization
Military
Chilean military
Armenian military
Latvian military
Romanian military
Danish military
Portuguese military
Greek military
Danish military
Saudi military
United Arab Emirates army
Kuwaiti military
Romanian military
Bulgarian military
Ministry of Defense
MOD of Bulgaria
MOD of Poland
MOD of Hungary
MOD of Albania
MOD of Spain
MOD of Afghanistan
MOD of Saudi Arabia
MOD of Poland
Ministry of Foreign Affairs
MFA of South Georgia
MFA of Armenia
MFA of the United Arab Emirates
MFA of the United Arab Emirates
MFA of Qatar
Intelligence Units
State Agency for National Security (Bulgaria)
Defense Industry
Academi
Boston Dynamics
SAIC
Polski Holding Obronny
Media
New York Times
New York Times

Phishing URL
mail.fach.rnil.cl
mail.rnil.am
web.mailmil.lv
fortele.ro
webmail-mil.dk
webmail.exerclto.pt
webmail-mil.gr
fkit-mil.dk
mail.rsaf.qov.sa.com
www.mailmil.ae
mail.kuwaitarmy.gov-kw.com
mail-navy.ro
mail.armf.bg.message-id8665213.tk
mail.arnf.bg
poczta.mon.q0v.pl
mail.hm.qov.hu
mod.qov.al
mail.mod.qov.es
mail.mod.qov.af
mail.moda.qov.sa.com
poczta.mon-gov.pl
email.mfa.qov.gs
webmail-mfa.am
webmail.mofa.qov.ae
webmail.mfa.qov.ae
mail.mofa.g0v.qa
dansa.bg
mail.academl.com
mail.bostondynamlcs.com
webmail-saic.com
mailpho.com
privacy-yahoo.com
link.candybober.info
3

Trend Micro | How Cyber Propaganda Influenced Politics in 2016

Date
24-Aug-15
24-Feb-16
14-Mar-16
15-Mar-16
11-May-16
12-Jun-16
14-Nov-16
14-Nov-16
15-Nov-16
16-Nov-16
21-Nov-16
12-Jan-16
12-Jan-16
01-Feb-16
01-Feb-16
01-Mar-16

Organization
Sanoma Media
Hurriyet
Anadolu Agency
Anadolu Agency
Hurriyet
Hurriyet
Al Jazeera
Al Jazeera
Al Jazeera
Al Jazeera
Al Jazeera
Politics
Prime Minister of Turkey
Prime Minister of Turkey
Prime Minister of Turkey
Parliament of Turkey
Democratic Party (US)

01-Apr-16

Democratic Party (US)

22-Apr-16
06-May-16
06-Jun-16
20-Oct-16

CDU (Germany)
CDU (Germany)
Democrat Party (US)
Parliament of Montenegro
Academics
Tartu University
Government Agencies
Government of Montenegro
Safety Board Netherlands
Safety Board Netherlands
Government of Montenegro
Energy
Westinghouse Nuclear
International Organizations
Organization for Security and Co-operation in
Europe
Partnership for Peace Information Management
System
World Anti-Doping Agency
World Anti-Doping Agency
Court of Arbitration for Sport

04-Mar-16
24-May-15
14-Sep-15
28-Sep-15
03-Nov-15
10-Dec-14
18-Jun-14
23-Apr-15
03-Aug-16
08-Aug-16
08-Aug-16

Phishing URL
mobile-sanoma.net
posta-hurriyet.com
anadolu-ajansi.com
mail.anadoluajansi.web.tr
webmail-hurriyet.com
mail-hurriyet.com
account-aljazeera.net
ssset-aljazeera.net
sset-aljazeera.net
sset-aljazeera.com
mail-aljazeera.net
e-post.byegm.web.tr
mail.byegm.web.tr
eposta.basbakanlik.qov.web.tr
e-posta.tbmm.qov.web.tr
myaccount.google.comsecuritysettingpage.gq
myaccount.google.comchangepasswordmyaccountidx8jxcn4ufdmncudd.gq
webmail-cdu.de
support-cdu.de
actblues.com
mail-skupstina.me
mail.university-tartu.info
mail-gov.me
vpn.onderzoekraad.nl
sftp.onderzoekraad.nl
mail.g0v.me
webmail.westinqhousenuclear.com
login-osce.org
mail-pims.org
mail.wada-awa.org
inside.wada-arna.org
tas-cass.org

Trend Micro Incorporated, a global leader in security software, strives to make the
world safe for exchanging digital information. Our innovative solutions for consumers,
businesses and governments provide layered content security to protect information
on mobile devices, endpoints, gateways, servers and the cloud. All of our solutions
are powered by cloud-based global threat intelligence, the Trend Micro Smart
Protection Network, and are supported by over 1,200 threat experts around the
globe. For more information, visit www.trendmicro.com.
2017 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend
Micro t-ball logo are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.

10101 N. De Anza Blvd.

Cupertino, CA 95014
U.S. toll free: 1 +800.228.5651
Phone: 1 +408.257.1500
Fax: 1 +408.257.2003