Russians Claiming to Represent IS Threatened US Military Wives

Angela Ricketts' husband is in the United States Army.

On February 10, 2015, she received a text message: "Dear Angela!" it read. "Bloody Valentine's Day!"

"We know everything about you, your husband and your children," the Facebook message continued.

The writer claimed to represent the Islamic State, or IS militant group. The message said the militants had gained control of her computer and telephone.

Ricketts was one of five military wives who received death threats from the self-declared CyberCaliphate.

However, they were not from IS.

The Associated Press says it has found evidence that the women were targeted by a Russian group known for attacking computers. It reportedly is the same group that was active during the U.S. presidential election campaign two years ago. The Russian hackers released emails from John Podesta, the chairman of Hillary Clinton's presidential election campaign.

The operation is similar to the online campaign by Russian hackers to spread false information in the months before the 2016 elections.

Links between CyberCaliphate and the Russian hackers, often called "Fancy Bear" or "APT28," have been documented earlier in both the U.S. and Europe. But this information had not been shared with the women involved. Many of the women believed they had been targeted by Islamic State supporters.

"Never in a million years did I think that it was the Russians," said Ricketts, a writer and activist for military families and veterans.

Completely new ground

At the same time that Ricketts received her message, four other women across the country received similar messages.

Liz Snell, wife of a U.S. Marine, was at her husband's retirement ceremony in California when she found that the Twitter account of her group, Military Spouses of Strength, had been attacked. It was broadcasting public threats to herself, the other women and their families. The threats also reached Michelle Obama, when her husband Barack Obama was U.S. president.

The women later found they had all received the same threats. However, they refused to be frightened.

"Fear is exactly what — at the time — we perceived ISIS [IS] wanted from military families," said Lori Volkman, one of the victims.

Volkman and the other wives decided to share their stories through different media organizations.

"Military families are prepared to deal with violence that's directed toward our soldiers," Ricketts told Fox News. "But having it directed towards us is just completely new ground."

‘We might be surprised'

On April 9, 2015, almost two months after the wives were threatened, the television signal of French broadcaster TV5 Monde went dead.

The station's communications equipment had been damaged, and its internal messaging system disabled. On the station's website and Facebook page was the sign of CyberCaliphate.

The cyberattack shocked France. Interior Minister Bernard Cazeneuve said evidence suggested the broadcaster was the victim of an attack of terror.

But Guillaume Poupard, the chief of France's cybersecurity agency, was not ready to support the minister's claim.

"We should be very prudent about the origin of the attack," he told French radio. "We might be surprised."

Government experts later found evidence the attack did not come from the Middle East, but Moscow.

Speaking to the AP last year, Poupard said the attack "resembles a lot what we call collectively APT28."

The Russian government has repeatedly denied plotting attacks against Western targets.

Similar goals

A cybersecurity company called Secureworks provided evidence to the AP that the military wives were targeted by Russian hackers. Recent AP research found that a group called Fancy Bear, which Secureworks calls "Iron Twilight," was trying to break into the military wives' email at same time that CyberCaliphate sent its messages.

Lee Foster, with cybersecurity company FireEye, said the fact that the Russian hacking and CyberCaliphate activities happened at the same time makes it clear the groups were linked.

The CyberCaliphate's attacks are similar to the activities of a group called the St. Petersburg troll farm. It paid Russian employees to put false information into social media. They tried to raise fears of the IS militants' threat to the United States by producing false stories of IS attacks.

The AP said it has found no link between CyberCaliphate and the St. Petersburg trolls. However, their goals appeared to be the same: keep tensions high and extremist Islam in the news.

I'm Phil Dierking.

Raphael Satter reported this story for the Associated Press. Phil Dierking adapted his story for VOA Learning English. George Grow was the editor.

Have you ever been the victim of a cyber-attack? Write to us in the Comments Section or on testbig.com.

______________________________________________________________

Words in This Story

Valentine - n. a card or gift that you give usually to someone you love on Valentine's Day

online - adj. connected to a computer, a computer network, or the Internet

veteran - n. : someone who fought in a war as a soldier, sailor, etc.

spouse - n. a husband or wife

perceive - v. to notice or become aware of something

internal - adj. existing or located on the inside of something

cybersecurity - n. he state of being protected against the criminal or unauthorized use of electronic data, or the measures taken to achieve this.

prudent - adj. having or showing careful good judgment

resemble - v. to look or be like (someone or something)

troll farm - n. an organization whose workers try to create conflict in an online community