# US Election Security: Voting Machine Patch Gaps and AI-Enabled Influence Campaigns

> SecurityWeek (2026-10-29) reports that EAC certification timelines can leave US voting machines unpatched for up to two years, and that every machine delivered to DEF CON's Voting Village has been compromised once researchers had hands-on access. The article also describes AI-enabled deepfakes, robocalls, disinformation and phishing against election officials, aimed chiefly at undermining public trust rather than altering votes.

- **Published:** 2026-10-29T20:10:03Z
- **Last reviewed:** 2026-10-29T20:10:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4767
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4767.png
- **ID:** TL-2026-4767
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

This record is a contextual, analysis-type threat entry rather than a newly disclosed incident. No CVEs, CVSS scores or technical IOCs are stated in the source. Severity (MEDIUM) and status (MONITORING) are analyst judgments; no active exploitation of voting machines is reported.

Patch gap: Shai Bargil (CEO, Sequent) told SecurityWeek that certification of voting systems can occur in any of four election-cycle years and that the process can take up to two years, so that in the worst case machines run software that has gone unpatched for two years or more after certification. He also states that every voting machine delivered to the DEF CON Voting Village, a hands-on election-security lab giving legal access to voting equipment, has been successfully hacked once researchers had hands-on access. Earlier DEF CON Voting Village reports (DEF CON 27, 2019; 2018 and 2024 coverage) similarly describe long-lived unpatched flaws and note that major software changes can force a re-certification process costing over $1 million, which is why fixes are slow to deploy. Physical access is the common precondition in the Voting Village findings. Existing safeguards cited include pre-election testing, chain-of-custody controls, bipartisan poll workers and post-election audits of paper ballots.

Influence operations: Expert commentary in the article (Adam Marre, Arctic Wolf; Bobby Ford, Doppel) states that most observed activity targets disinformation campaigns, social media manipulation, cyber espionage, phishing of election officials and disruption of election-related services rather than direct vote changes, and that attackers can shape public perception through impersonation, fake websites and AI-generated misinformation. The article recounts the 2016 Russian influence campaign (attributed by the CIA, NSA and FBI in 2017, by Special Counsel Robert Mueller in 2019 and by the Senate Intelligence Committee in 2020) and the 2024 Iranian hack-and-leak operation against the Trump campaign. In that case the FBI, ODNI and CISA issued a joint statement on 2024-08-19 attributing the operation to Iran; the campaign had confirmed a breach on 2024-08-10, and documents were leaked to media from an AOL account using the pseudonym 'Robert'. Press reporting says the techniques matched an IRGC-affiliated group; Iran denied involvement.

AI-enabled voter suppression: In January 2024 a deepfake robocall imitating President Biden's voice, delivered with spoofed caller ID two days before the New Hampshire primary, urged Democrats to stay home. The FCC finalized a $6 million fine against political consultant Steve Kramer, who also faced 26 criminal counts in New Hampshire, and Lingo Telecom agreed to a $1 million settlement for transmitting the calls. Alex Quilici (YouMail) notes that targeted robocalls and robotexts are the simplest way to get voters to stay home.

Recommendations in the source: open-sourcing voting-machine software for external review, encrypted verifiable voting records (for example Microsoft ElectionGuard homomorphic encryption), and a CTEM approach emphasizing access control, verifiable backups and multi-layer redundancy. Defenders should focus on phishing resilience for election staff, brand/domain impersonation monitoring, telecom-level robocall authentication, and physical custody of voting equipment.

## MITRE ATT&CK

- T1566 Phishing
- T1684.001 Impersonation
- T1585.002 Establish Accounts: Email Accounts
- T1585.001 Establish Accounts: Social Media Accounts
- T1583.001 Acquire Infrastructure: Domains
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1565.001 Data Manipulation: Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-4767 Election-Themed Lookalike Sender Domain with Credential Lure (T1566)** (`TL-2026-4767-SPL-001`)

Detects inbound email from non-government domains that impersonate election offices (election, voter, ballot, county clerk, secretary of state terms) and carry credential or urgency lure subjects. Phishing and impersonation of election officials is the dominant activity cited in the SecurityWeek analysis, and the 2024 hack-and-leak against the Trump campaign began with account compromise. Behaviour-first: it keys on sender-domain impersonation plus lure wording, not static IOCs, because the source publishes no network indicators.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1583.001, T1656
- **Data sources:** office365_message_trace, email_security_gateway
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=email sourcetype="o365:reporting:messagetrace" earliest=-24h
| eval sender_domain=lower(mvindex(split(SenderAddress,"@"),1))
```comment("TL-2026-4767 T1566/T1583.001/T1656: election-themed lookalike sender domain that is not .gov or .mil")```
| where match(sender_domain,"(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)")
| where NOT match(sender_domain,"(?i)[.](gov|mil)$")
| where match(lower(Subject),"(?i)(verify|password|credential|urgent|suspend|voter roll|login)")
| stats count AS msgs dc(RecipientAddress) AS recipients values(Subject) AS subjects min(_time) AS first_seen BY sender_domain SenderAddress
| convert ctime(first_seen)
| sort - recipients
````

### Microsoft KQL

```kql
EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex "(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)"
| where SenderFromDomain !endswith ".gov" and SenderFromDomain !endswith ".mil"
| where Subject matches regex "(?i)(verify|password|credential|urgent|suspend|voter roll|login)"
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 10), FirstSeen=min(Timestamp) by SenderFromDomain, SenderFromAddress
| order by Recipients desc
```

### Sigma

```yaml
title: Election-Themed Lookalike Sender Domain with Credential Lure
id: 3f6c1a52-8b7e-4d19-a2c4-91e5b07d3a10
status: experimental
description: Detects inbound email from non-government domains impersonating election offices that use credential or urgency lure subjects (TL-2026-4767).
references:
    - https://www.securityweek.com/how-secure-are-us-elections-voting-machine-risks-and-the-growing-threat-of-ai/
author: Threadlinqs Team
date: 2026-10-29
tags:
    - attack.initial-access
    - attack.t1566
    - attack.resource-development
    - attack.t1583.001
    - attack.defense-evasion
    - attack.t1656
logsource:
    product: office365
    service: messagetrace
detection:
    selection_domain:
        SenderDomain|re: '(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)'
    selection_subject:
        Subject|re: '(?i)(verify|password|credential|urgent|suspend|voter roll|login)'
    filter_gov:
        SenderDomain|endswith:
            - '.gov'
            - '.mil'
    condition: selection_domain and selection_subject and not filter_gov
falsepositives:
    - Legitimate election-services vendors, voter-registration NGOs and news outlets sending from commercial domains
level: medium
```

**Known false positives:**

- Legitimate election-services vendors, voter-registration NGOs and news outlets mailing from commercial domains
- Internal phishing-awareness simulations that use election-themed lookalike domains

**Tuning notes:** Add trusted vendor and NGO domains to an exclusion list, scope recipients to election-office and campaign mailboxes, and extend the term list with your jurisdiction's names. Raise severity when recipients >= 5 or the domain was registered in the last 30 days.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-4767 Host Resolves Election-Themed Lookalike Domain (T1583.001) (locked: unlock with TL Creds)
- TL-2026-4767 Free-Webmail Sender Impersonating Election Officials (T1656) (locked: unlock with TL Creds)
- TL-2026-4767 Removable Media or New Device Connected to Election Management Host (T1200, T1091, T1052.001) (locked: unlock with TL Creds)
- TL-2026-4767 Office or PDF Reader Spawns Script Interpreter (Phishing Attachment Execution) (locked: unlock with TL Creds)
- TL-2026-4767 Election Management Data File Modified or Deleted Outside Approved Process (T1565.001, T1485, T1070.004) (locked: unlock with TL Creds)
- TL-2026-4767 Request Flood Against Election Information Web Endpoints (T1498, T1499.002) (locked: unlock with TL Creds)
- TL-2026-4767 Exchange Online Forwarding or Mail-Hiding Rule on Election Mailboxes (Hack-and-Leak Staging) (locked: unlock with TL Creds)
- TL-2026-4767 Mass Robocall with Weak STIR/SHAKEN Attestation or Synthetic Voice (Voter Suppression) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI](https://www.securityweek.com/how-secure-are-us-elections-voting-machine-risks-and-the-growing-threat-of-ai/)
- [NPR: A political consultant faces charges and fines for Biden deepfake robocalls](https://www.npr.org/2024/05/23/nx-s1-4977582/fcc-ai-robocall-biden-new-hampshire-primary-kramer)
- [WBUR: FCC finalizes $6M fine for Steve Kramer over Biden robocalls](https://www.wbur.org/news/2024/09/27/steve-kramer-biden-robocalls-fines)
- [TechCrunch: US government accuses Iran of Trump campaign hack](https://techcrunch.com/2024/08/20/us-government-accuses-iran-of-trump-campaign-hack-iran-scoffs)
- [DEF CON 27 Voting Village Report](https://harris.uchicago.edu/files/def_con_27_voting_village_report.pdf)
- [Boing Boing: Report from DEF CON's Voting Village reveals ongoing dismal state of US electronic voting machines](https://boingboing.net/2019/09/27/dumpster-fires-r-us.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4767