Microsoft says Iranian hackers targeted US political campaigns

A hacking group linked to the Iranian government tried to breach the email accounts of presidential campaign staffers as part of a wider effort to gather intelligence ahead of the U.S. election, Microsoft Corp. said Friday.

Attackers connected to the Islamic Revolutionary Guard Corps in June used a compromised email address from a former political adviser to try phishing another high-ranking presidential campaign official, according to findings from Microsoft’s Threat Analysis Center. That group, which Microsoft calls Mint Sandstorm, also unsuccessfully attempted to log in to the account of a former presidential candidate. The report didn’t identify the individual targets by name.

Other Iranian groups are using artificial intelligence technology to publish content online insulting former president Donald Trump and create inflammatory posts about controversial issues such as gender reassignment surgery, according to the report.

Microsoft researchers also said that Iranian groups that have historically tried to undermine trust in the electoral system have since March been preparing to launch influence operations. Using websites with fabricated and plagiarized content, supposed media operations launched by Iranian groups also have sought to amplify polarizing political messaging about topics such as presidential candidates and Israel’s war against Hamas, researchers found.

“Iran's cyber capabilities are defensive and proportionate to the threats it faces,” Ali Karimi Magham, a spokesperson for Iran's mission to the United Nations in New York, said in an emailed statement. “Iran has neither the intention nor plans to launch cyber attacks. The U.S. presidential election is an internal matter in which Iran does not interfere.”

The findings are the latest evidence that foreign governments are conducting clandestine operations ahead of U.S. elections in November. American intelligence officials in July warned that Russia, China and Iran were recruiting people in the U.S. to spread propaganda. A representative from the Iranian government denied that allegation.

Iranian operatives in 2020 impersonated members of the right-wing Proud Boys group as part of a voter intimidation effort, according to the FBI, resulting in charges against two men. That same year, Iranian hackers breached a website that a municipal government in the U.S. used to publish election results, though the attackers were caught before carrying out any nefarious activity, U.S. cybersecurity officials said.

Nation-state hackers have long used email attacks to try infiltrating American political campaigns, such as the Russian hack in 2016 in which a state-sponsored group ultimately published internal emails from Hillary Clinton’s staffers.

The U.S. State Department on Wednesday identified six alleged Iranian hackers accused of compromising industrial control systems used by American public utilities.

(Updated to include response from an Iranian government representative in fifth paragraph.)