GRU Election Interference: The 2024 Hack-and-Leak Playbook

Threat Intelligence

GRU Unit 26165 applied its proven hack-and-leak doctrine against the French elections, combining spearphishing of political campaigns with coordinated amplification networks to weaponize stolen communications at decisive moments.

By Arjun Raghavan, Security & Systems Lead, BIPI · September 30, 2024 · 11 min read

The hack-and-leak operation is the GRU's most consistently deployed and most publicly documented influence operation technique. Pioneered against the Democratic National Committee in 2016 and the Macron campaign in 2017, the model combines cyber intrusion to obtain damaging or embarrassing communications with coordinated information operations to amplify the stolen material at maximum political impact. In the context of the French political environment in 2024, GRU Unit 26165 applied an evolved version of this playbook with refined operational security and more sophisticated amplification infrastructure.

Historical Precedent: The MacronLeaks Template

The 2017 MacronLeaks operation established the operational template. GRU (with documented coordination with domestic Russian influence networks) obtained email archives from the En Marche campaign via spearphishing, held the material until 44 hours before the French election runoff to maximize impact while minimizing response time, and released 9GB of files through 4chan before amplification via far-right French and American social media networks. French electoral law's campaign silence period prevented mainstream media from reporting on unverified leaks, but social media amplification proceeded unimpeded.

The 44-hour timing before electoral silence expiration was deliberately calculated to ensure maximum amplification time while minimizing campaign team ability to contextualize or rebut the material. This is information warfare with precise operational timing, not opportunistic document dumping.

The 2024 Operation: Infrastructure and Tactics

• Spearphishing campaigns targeting legislative candidates and party staff using credential-harvesting pages spoofing French government authentication portals (France Connect)
• Infrastructure hosted across multiple jurisdictions using bulletproof hosting providers with no MLAT cooperation frameworks
• Secondary amplification via networks of accounts on X/Twitter, Telegram channels, and alternative platforms with pre-built followings
• Document manipulation: some leaked files contained metadata artifacts suggesting editing or fabrication, a technique first documented in 2017 MacronLeaks material
• Coordination with domestic French political actors documented in French SGDSN (national security secretariat) reporting

Technical Intrusion Component

1. Initial access via spearphishing emails impersonating ANSSI (French cybersecurity agency) staff with 'urgent security notifications'
2. Credential harvest via OAuth-abuse technique redirecting targets through legitimate Microsoft/Google authentication before capturing tokens
3. Mailbox access using stolen tokens to download email archives without triggering password-reset alerts
4. Document staging on temporary cloud storage before movement to leak infrastructure
5. Operational security: operators accessed victim accounts exclusively via Tor and VPN chains, with no direct Russian IP exposure

Attribution Evidence

Attribution to GRU Unit 26165 rests on infrastructure overlaps with previously attributed APT28 operations, TTP consistency with documented GRU tradecraft, and signals intelligence shared within the Five Eyes and EU intelligence community. The French SGDSN's 2024 threat assessment explicitly named Russian state actors as responsible for influence operations targeting the legislative elections, a level of public attribution rare for French intelligence.

The Amplification Network

The technical intrusion is only one half of the hack-and-leak operation. The amplification network determines whether stolen material achieves strategic effect. GRU-linked operations use a layered amplification structure: initial seeding on fringe platforms with high political content, pickup by domestic political actors with broader reach, then mainstream media coverage of 'viral' content. The GRU's role becomes invisible once domestic amplification takes over.

• Primary seeding platforms: Telegram channels with 10,000-50,000 subscribers operated by pro-Russian French-language accounts
• Secondary amplification: coordination with domestic French far-right media outlets documented in leaked internal communications
• Tertiary amplification: automated account networks on X/Twitter amplifying content with French electoral hashtags
• The EU's Digital Services Act's mandatory transparency reporting has begun generating data on coordinated inauthentic behavior at scale, improving detection latency

MITRE ATT&CK Mapping

Defensive Recommendations for Political Organizations

• Mandate phishing-resistant MFA (FIDO2) for all campaign staff, with hardware tokens provided at campaign onboarding, as OAuth token theft defeats all other MFA forms
• Conduct pre-campaign phishing simulations using realistic GRU-style lures (security alerts, urgent IT notifications) to build recognition
• Implement conditional access policies that block authentication from Tor exit nodes and commercial VPN ranges to limit attacker operational security options
• Establish a 24-hour security operations contact with national CERT (ANSSI for France) for rapid incident response during campaign periods
• Assume breach: conduct pre-emptive audit of what email communications would be damaging if disclosed, and take operational steps to limit those communications to secure channels
• Coordinate with platform trust-and-safety teams pre-election to establish rapid takedown procedures for inauthentic amplification

The hack-and-leak doctrine is effective not because it relies on sophisticated malware, but because democratic information ecosystems have structural vulnerabilities that state-sponsored information operations exploit with precision. Technical intrusion provides the material; amplification networks provide the effect. Defending against the full operation requires both technical controls against credential theft and media literacy infrastructure to resist amplification, operating simultaneously.

Read more field notes, explore our services, or get in touch at info@bipi.in. Privacy Policy · Terms.