Iran blamed for hacking election campaign, demand for FBI investigation into risk of interference in election

(Bloomberg) — Suspected attempts by Iranian hackers to infiltrate the U.S. presidential campaign have broadened a federal investigation into the first major attempt by a foreign actor to disrupt the November election.

Investigators believe Iran-linked attackers succeeded in hacking Republican candidate Donald Trump’s campaign and gaining access to internal documents, according to a U.S. law enforcement official who spoke on the condition of anonymity to discuss the matter. The intruders also tried to break into the campaigns of Vice President Kamala Harris and President Joe Biden before they dropped out, but it’s unclear whether the hacking attempts on the Democrats were successful, the official said.

The investigation, led by the Federal Bureau of Investigation, follows a report last week by Microsoft Corporation that described efforts by the Iranian government to access the email accounts of presidential campaign staff. Microsoft said the attacks were carried out by a hacking cell called Mint Sandstorm, which is linked to Iran’s Islamic Revolutionary Guard.

The Iranian hacking allegations come just weeks after US intelligence officials warned that foreign adversaries — including Iran and Russia — would seek to influence the 2024 election in ways favorable to their interests. That includes recruiting Americans to spread disinformation, according to the Office of the Director of National Intelligence.

Microsoft’s report did not identify the targeted campaigns by Iran, but said it had notified the affected parties. Trump acknowledged the breach in a post on his Truthout social network, where he described the intrusion as an attempt to interfere with the election. The law enforcement official confirmed that Microsoft’s report was consistent with the ongoing investigation.

A Harris campaign official said last month the FBI notified her legal and security teams that she had been targeted by a foreign influence operation. The campaign is not aware of any breach of its systems and has been in touch with authorities, the official said, speaking on the condition of anonymity to discuss a security issue.

Iran’s mission to the United Nations has denied the allegations. “We place no credence in such reports,” the mission said in a statement. “The Iranian government has no intention or motive to interfere in the United States presidential election and does not intend to do so.”

US officials and cybersecurity experts believe Iran’s government is trying to undermine Trump’s candidacy because he angered Tehran during his first term. As president, Trump abandoned an international nuclear deal with Iran, imposed tough sanctions on the Islamic republic and ordered the killing of Iran’s Revolutionary Guard Corps chief Qassem Soleimani.

“The regime views Trump as hawkish on Iran and likely prefers Harris, based on Trump’s history of ties with Iran,” said David Salvo, managing director of the German Marshall Fund’s Alliance for Securing Democracy.

Listen to the Here’s Why podcast on Apple, Spotify or wherever you listen.

The news comes as US officials prepare for a possible attack by Iran on Israel in retaliation for the killing of Hamas leader Ismail Haniyeh in Tehran last month, as the conflict in Gaza threatens to spiral into a wider regional conflagration.

“The war in Gaza is enough fuel for the Iranian regime to increase its information campaigns against us,” Salvo said. “This election has real consequences for the Middle East.”

Iran has tried to disrupt past US elections. In 2020, its operatives impersonated members of the right-wing Proud Boys group as part of an effort to intimidate voters, resulting in charges against two men, according to the FBI. That same year, Iranian hackers breached a website used by a municipal government in the US to publish election results, though the attackers were caught before they could carry out any nefarious activity, US officials said.

The FBI did not immediately comment. A spokesman for the Cybersecurity and Infrastructure Security Agency referred questions about the Trump campaign hacking to the Justice Department.

Microsoft cited a so-called spearphishing email sent in June from a “compromised email account of an unnamed former Trump adviser to a high-ranking official in the presidential campaign.” Though he was not named in Microsoft’s report, Roger Stone, a close Trump ally, was told months earlier by FBI and Microsoft officials that two of his email accounts had been breached by a foreign state actor, according to a person familiar with the matter.

Federal authorities told Stone that the hackers aimed to use his email accounts to send phishing emails to people in the Trump campaign, the person said. Stone rarely uses the accounts and has no idea how they may have been accessed, the person said, adding that Stone is cooperating with authorities.

On Wednesday, Google’s threat analysis group published a blog post praising Microsoft’s findings. Alphabet Inc’s Google said that in May and June Iranian hackers targeted the personal email accounts of about a dozen individuals connected to Biden and Trump, including current and former U.S. government officials and individuals associated with their campaigns. Google blocked multiple attempts by the attackers to log into the personal email accounts of potential victims.

Google also found that Iranian hackers successfully gained access to the personal Gmail account of a high-profile political adviser, whose identity it did not disclose. Google reported the malicious activity to law enforcement in early July, and it also warned campaign officials about increased hacking attempts by foreign state actors, according to the posting.

The news of the Trump campaign hack was first reported by Politico, which said last week that it began receiving emails containing alleged internal campaign documents from an anonymous account last month. According to Politico, those files included a dossier on Senator J.D. Vance, Trump’s running mate for vice president.

In his Truth Social post, Trump insisted that only “publicly available information” was affected, and his campaign warned media outlets not to publish any materials obtained from the breach.

Nation-state hackers have used email attacks to infiltrate US political campaigns before, such as the Russian hack in 2016, when a state-sponsored group obtained internal emails from Hillary Clinton’s staff that were later published by WikiLeaks. It is unclear whether the material sent to Politico and other news organizations came through suspected Iranian hackers.

Former CISA Director Christopher Krebs said the goal of US adversaries is to spread chaos.

“It’s undermining our confidence in the ability of our government, and democracy in general, to provide us with basic services and take care of us,” Krebs told PBS NewsHour.

– With assistance from Jamie Tarabay, Charles Gorrivan, Josh Wingrove, Jake Bleiberg, Billy House and Hadriana Lowenkron.

(Update begins at 16th paragraph with new information from Google’s threat analysis group.)

More stories like this are available here bloomberg.com