Romanian elections targeted with cyberattacks by foreign state-sponsored actors – Source: www.csoonline.com

Romania, an EU and NATO member state, faced tens of thousands of intrusion attempts — some successful — that targeted its election IT infrastructure before and during the first round of its presidential elections, according to a report from the country’s main intelligence service. 

The Romanian Intelligence Service (SRI), which operates the National Cyberint Center tasked with detecting and blocking cyberattacks against critical infrastructure, attributed the campaign targeting websites and servers supporting the electoral process to a potential state-sponsored threat actor with a high degree of confidence.

“The mode of operation, as well as the scale of the cyber campaign, lead to the conclusion that the attacker possesses considerable resources, consistent with a mode of operation specific to a state-sponsored attacker,” the SRI stated in an intelligence briefing to the Romanian Presidential Administration.

“At the same time, the AEP [Permanent Electoral Authority] infrastructure remains affected by vulnerabilities which, if exploited, could enable attackers to escalate access within the network and maintain persistence.”

Two SRI reports marked as Top Secret, along with briefings from other Romanian intelligence services, were presented at a November 28 meeting of the Romanian Supreme Council for National Defense (CSAT) following the first round of elections. Acting President Klaus Iohannis declassified the reports on Wednesday.

Influence campaign raises concerns ahead of runoff election

The presidential runoff is scheduled for Sunday amid concerns that the leading candidate, far-right ultranationalist Calin Georgescu — a NATO and EU critic and admirer of Russian President Vladimir Putin — benefited from a massive influence campaign on TikTok. The campaign reportedly involved tens of thousands of coordinated accounts linked to Telegram channels, spreading messages that were not properly labeled as political advertisements, as required by electoral law.

The TikTok campaign amplified Georgescu’s populist, religious, and nationalist messaging, catapulting him from low single-digit support in polls weeks before the election to the leading position in the first round, receiving 23% of the vote. Georgescu will now face center-right candidate Elena Lasconi who has the support of several pro-EU and pro-NATO parties.

While the SRI reports do not explicitly name Russia as the state behind the cyberattacks or the TikTok influence campaign, a separate declassified briefing from the Romanian Foreign Intelligence Service (SIE) highlights the threat from Russian efforts to influence public opinion and election campaigns in Western countries and Romania.

Leaked credentials and intrusion attempts

On Nov. 24, the day of the first-round election, the SRI detected leaked credentials for Romanian election-related websites on a Russian cybercrime forum. These credentials were also shared in a private Telegram group known for distributing stolen data, though notably not data from Russia.

The targeted websites included bec.ro (Central Electoral Bureau), roaep.ro (Permanent Electoral Authority) and registrulelectoral.ro (the electoral registry). All these websites are managed by the AEP, the agency that oversees the election process. AEP also uses technical support and IT infrastructure and systems designed by the Romanian Special Telecommunication Service (STS), a signals intelligence agency that serves as the Romanian government’s ISP.

SRI notes that the theft of credentials associated with these websites, in the form of usernames and passwords, was achieved either by targeting individual users or by exploiting vulnerabilities in a training website created by the STS for election officials at operatorsectie.roaep.ro. Additionally, the SRI confirmed that on November 19, a server hosting mapping data, gis.registrulelectoral.ro, was compromised. This server was connected to both the AEP’s internal network and the internet.

Before and during election day, SRI cybersecurity analysts recorded more than 85,000 attempts to exploit vulnerabilities such as SQL injection (SQLi) and cross-site scripting (XSS) in various electoral websites and IT systems. The attacks aimed to gain unauthorized access to data stored in databases, potentially alter voting information presented to the public, or disrupt the infrastructure’s availability.

The attacks originated from systems in over 33 countries, with attackers using anonymization techniques to complicate attribution. The SRI said at the time of its report that it was continuing to evaluate logs from cybersecurity monitoring systems in collaboration with the AEP and STS to determine whether the electoral process was impacted.

STS reports no critical issues impacting the electoral process

During the same CSAT meeting, STS officials presented their own briefing that has now been declassified, in which they stated that no vulnerabilities or malfunctions were identified that could have impacted the secure and optimal operation of its IT systems and services.

“All external access points to the system, such as computer terminals, communication access resources at polling stations, and specific applications, were evaluated from a cybersecurity perspective prior to operationalization and were continuously monitored before, during, and after the electoral process by teams of technical system administrators, as well as within operational centers for network and security monitoring organized at the STS level, with no anomalies reported,” the agency noted.

Cyberattacks highlight risks to internet-enabled elections

Romania does not use electronic voting but relies on IT systems developed by the STS for the AEP to prevent fraud. These systems validate and record national ID cards at polling stations to prevent multiple voting, record the vote-counting process on video, photograph official counting reports, and transmit them to central authorities. A website is also used to present real-time vote-counting data to the public as the official reports from polling stations come in and are centralized.

After the CSAT meeting, but likely unrelated to it, the Romanian Constitutional Court ordered a complete recount of all paper ballots after receiving complaints from two candidates signaling potential fraud. While the recount found some counting errors at some stations in the country, the errors were not big enough to change the results of the first round. There have been calls over the years to implement electronic or internet voting, which would allow citizens to vote more easily, especially when they’re traveling to different parts of the country. However, cyberattacks such as the ones documented in the SRI reports against electoral IT infrastructure are likely to deter the adoption of such systems. Many security experts have argued against electronic or internet-based voting due to the cybersecurity risks that come with it.