GRU 'Someone has your password' phishing of the DNC and Clinton campaign (2016)

What happened

Beginning by at least March 2016, GRU officers targeted over 300 individuals affiliated with the Clinton Campaign, DCCC, and DNC. On or about March 19, 2016, they sent the campaign chairman a spearphishing email that spoofed a Google security notification and masked a link with the john356gh URL-shortening account. The instructions were followed, and on or about March 21, 2016, the GRU stole over 50,000 emails from the chairman's account. Additional spearphishing emails were sent to other Clinton-affiliated individuals, including on or about March 25, 2016. The indictment alleges that GRU personnel also stole credentials and emails from numerous other individuals and staged stolen documents for release.

How it worked

The emails impersonated a trusted brand (Google) and used a fabricated security-alert pretext: a supposed unauthorized sign-in attempt, sometimes citing an IP address and a foreign location, demanding an immediate password change. The malicious destination, a GRU-controlled page that spoofed the real Google login screen, was hidden behind Bitly short links so recipients could not see the true URL. Per Secureworks, the phishing URL carried a Base64-encoded copy of the victim's own email address so the fake login page arrived pre-filled with their address, increasing believability. Because the Clinton campaign and DNC used Google/Gmail for mail, staff were conditioned to expect exactly this kind of Google login prompt. Entering credentials on the decoy page handed the attackers a live session and full mailbox access. The campaign was reconnaissance-driven and personalized; per the Mueller indictment, GRU officer Ivan Yermakov researched targets' names and Clinton-campaign affiliations on social media, placing it at the hyper-targeted end of spear phishing.

The lure and the tell

Lure: a fake Google "Someone has your password / suspicious sign-in" alert urging an urgent password reset via an embedded (Bitly-shortened) link. Tells: the sender address was spoofed rather than a genuine Google domain (one wave sent from a Russia-based Yandex account); the action link was a shortened URL masking a non-Google destination; and the fastest safe check, appending a "+" to a Bitly link or navigating to Google account settings directly instead of clicking, would have exposed the decoy login domain.

Outcome

The campaign chairman's 50,000+ emails and large volumes of DNC and DCCC material were exfiltrated and staged for release through the DCLeaks and Guccifer 2.0 personas. Twelve GRU officers were indicted by name in July 2018.

Why it matters

This is the canonical case that credential-harvesting spear phishing, not malware, is enough to compromise the highest-value targets: a single spoofed security alert and one clicked link opened a presidential campaign to a nation-state. It also shows how a human escalation step meant to protect the target (asking IT) can backfire, how brand-mimicking "reset your password" pretexts exploit good security hygiene messaging, and how URL shorteners defeat casual link inspection. It set the template studied in nearly every modern phishing-awareness program.

Defenses

Enforce phishing-resistant MFA (hardware security keys / FIDO2) so stolen passwords alone cannot grant access. Treat any "change your password" link in an inbound email as suspect; navigate to account security settings directly rather than clicking. Expand short links before trusting them (append "+" to a Bitly URL to preview the destination) and verify the true login domain before entering credentials. Deploy DMARC/SPF/DKIM and anti-spoofing controls, external-sender banners, and link rewriting/sandboxing. Give high-risk staff (executives, comms, finance, IT) targeted training and a fast, unambiguous IT escalation path, and enroll them in enhanced account protection programs.