Audit finds six election boards in MI, MO, ME, NH using a buggy version of email software Exim, which the NSA says has been targeted in attacks by Russia's GRU
Six jurisdictions used software that Russian spies have targeted in cyberattacks — Many of the thousands of county …
Context & Ripple Effects
The NSA warned in May that Sandworm had been exploiting a now-patched Exim flaw across ~2.5 million servers actively exploiting a now-patched flaw in Exim, so the audit question was always whether election offices sat in that exposed population — these six boards in Michigan, Missouri, Maine and New Hampshire did. It extends a documented pattern: Russian military intelligence spear-phished 100+ local election officials before the 2016 race sent spear-phishing emails to 100+ local election officials, and FBI-tracked breaches of state voter registration databases date to Arizona and Illinois in 2016 breached two state voter registration databases.
First-order effects
- Six election boards in MI, MO, ME and NH face immediate patching, forensic review, and pressure from state and federal election-security authorities on infrastructure they run themselves.
- The NSA's GRU attribution converts a routine software-version finding into a named-actor threat for those jurisdictions, forcing risk briefings rather than quiet maintenance.
Second-order effects
- Email is the attack surface grand jurors flagged as a channel for false voting instructions or fake results disseminating false voting instructions or election results — expect county-level scrutiny of mail-server hygiene nationwide, since thousands of counties run their own systems.
- Vendors and state IT agencies will likely fold mail-transfer-agent patching into election-security checklists alongside voting-system controls, after ES&S's remote-access disclosure showed vendors' own claims need verification admitted some voting systems sold to states had a remote access feature.
Third-order effects
- If decentralized election email keeps surfacing as an entry point — as with the Texas county whose mail system was used to send fake emails to voters malware attack on a rural Texas county's email system — federal guidance may push toward centrally managed, hardened communications for election officials instead of county-run servers.
The trend: Election security is expanding beyond voting machines to the ordinary office software around them — email above all — as foreign intelligence services target the periphery.