The 2024 United States presidential election is rapidly approaching, and malicious actors are capitalizing on the attention and activity surrounding the election season to execute their scams.

Fortinet recently released its FortiGuard Labs Threat Intelligence Report: Threat Actors Targeting the 2024 U.S. Presidential Election, which reveals and analyzes threats observed from January 2024 to August 2024 tied to U.S.-based entities, voters, and the electoral process. Researchers identified phishing scams, malicious domain registrations, and other threat activity that could impact the integrity and trustworthiness of the election process and the welfare of the participating citizens.

Understanding burgeoning threats and risks helps business leaders, citizens, and election officials adhere to policies and adopt technologies that prevent and mitigate malicious cyber incidents during the election season and beyond.

Phishing scams and fraudulent websites target voters

Phishing is among the most common cyberattack techniques today. Cybercriminals use artificial intelligence (AI) to speed up, scale, and increase the believability of their scams, increasing this threat.

The FortiGuard Labs research team observed malicious actors selling phishing kits created to impersonate U.S. presidential candidates and their campaigns on the darknet for just $1,260 each. These kits target voters and donors, harvesting personal information such as names, addresses, and credit card details in donation scams.

Humans are the first line of defense in cybersecurity. To avoid falling victim to phishing attacks, it’s crucial for business and technology leaders to conduct regular training sessions that raise awareness about common phishing tactics and other scams. Nearly 70% of respondents to Fortinet’s 2024 Security Awareness and Training Global Research Report believe their employees lack critical cybersecurity knowledge, up from 56% in 2023. Ongoing training initiatives should provide guidance on recognizing phishing emails, avoiding suspicious links and attachments, and reporting potential phishing attempts.

In addition to phishing kits that impersonate U.S. presidential candidates and their campaigns, since January 2024, FortiGuard Labs researchers identified more than 1,000 newly registered domain names that incorporate election-related terms and references to prominent political figures. This underscores the importance of remaining vigilant for suspicious behavior or activity leading up to major events and prioritizing good cyber hygiene.

Human error will always pose a challenge, as even the best-trained staff can fall victim to phishing attacks and other scams. Installing antivirus and anti-malware software on computers adds an extra layer of protection, especially against phishing attacks and credential theft.

Threat actors sell sensitive data on the darknet

The darknet has become a hub for U.S.-specific threats, where malicious actors trade sensitive information and often develop strategies to exploit vulnerabilities. Approximately 3% of the posts on these darknet forums involve databases related to business and government entities. These databases hold critical organizational data that is vulnerable to cyber exploits and a prime target for threat actors during the election season.

FortiGuard Labs analysis revealed a significant number of diverse databases available on darknet forums targeting the U.S., including Social Security numbers, usernames, email addresses, passwords, credit card data, dates of birth, and other personally identifiable information that could be used to challenge the integrity of the 2024 U.S. election. For instance, billions of records could be used in misinformation campaigns, which could lead to fraudulent activity, phishing scams, and account takeover.

Over 1.3 billion rows of combo lists – including usernames, email addresses, and passwords – signify a considerable risk of credential-stuffing attacks. In such attacks, cybercriminals use stolen credentials to gain unauthorized access to accounts. Enforcing multi-factor authentication and a strong password policy helps businesses and consumers prevent data and credential theft.

Further, organizations should leverage a security orchestration, automation, and response platform, which can detect unusual activities by privileged users and, if needed, block such activities. Maintaining complete and current data backups is essential with the uptick in ransomware attacks. However, not all data backup strategies are created equal. For example, tech leaders should not rely solely on online backups and should avoid using the same passwords for production environments and backups. It is advised to maintain a backup of a cloud backup in another off-site location. Additionally, all backups should be encrypted and should have an access control set.

Preventing and mitigating cyberattacks in a dangerous digital landscape

Cybersecurity measures are critical to safeguard the integrity of the U.S. 2024 presidential election and protect society. Business leaders and citizens must safeguard against potential attacks, take proactive measures, and remain vigilant during this heightened time.