Several groups with ties to Iran have ramped up their online influence campaigns targeting the United States ahead of November’s election, according to a new report from Microsoft’s Threat Analysis Center.
One group, Mint Sandstorm, which is run by the Islamic Revolutionary Guard Corps intelligence unit, sent a spear phishing email to a high-ranking official on a presidential campaign from a compromised email account of a former senior adviser. Microsoft did not identify which campaign it notified.
“Microsoft has not notified us of any campaign accounts having been targeted in this manner,” a Harris campaign official told the Washington Examiner.
The Trump campaign did not respond to a request for comment.
The same group, days later, unsuccessfully attempted to log into a former presidential candidate’s account. The former candidate has been notified.
“Looking forward, we expect Iranian actors will employ cyberattacks against institutions and candidates while simultaneously intensifying their efforts to amplify existing divisive issues within the U.S., like racial tensions, economic disparities, and gender-related issues,” the report said.
Another Iranian group, Storm-2035, has set up four fake partisan news websites posing as legitimate designed to inflame tensions. One site the group set up, called Nio Thinkers, is designed to look like a left-wing news site. It insulted former President Donald Trump, calling him an “opioid-pilled elephant in the MAGA china shop” and a “raving mad litigiosaur.”
The Savannah Times, another site they prop up, claims to be a “trusted source for conservative news in the vibrant city of Savannah.” It focuses on conservative perspectives on cultural topics, including LGBTQ and trans rights.
Microsoft said these sites likely use AI-enabled services to plagiarize the articles on them from actual U.S. publications.
Another group, Sefid Flood, specializes in impersonating activists to stoke chaos, and its efforts may go as far as to try to incite violence against political figures. In May, a different group with links to the IRGC, known as Peach Sandstorm, compromised a county-level official’s account as a part of a broader password accumulation operation from the group.
Tehran is “primarily focused on fueling distrust in the U.S. political institutions and increasing social discord,” an official with the Office of the Director of National Intelligence told reporters in late July, though it is also working to avoid a second Trump administration.
“Since our last update, the IC has observed Tehran working with the presidential election, probably because Iranian leaders want to avoid an outcome they perceive with increased tensions with the United States. Iran’s preference is focused on this core interest,” the ODNI official said.
The official would not directly affirm that Tehran was working against Trump, instead saying it is operating in the same way it did ahead of the 2020 election. The ODNI revealed back in 2021 that Tehran carried out a multi-pronged covert influence campaign intended to undercut Trump’s reelection.
Microsoft’s report also details some Russian interference efforts designed to inflame tension in the U.S. but also to its own benefit in Ukraine. One group, Storm-1516, pushes disinformation via fake news sites as well, and since April, it has pushed false narratives that the CIA directed a Ukrainian troll farm to disrupt the election, that Ukrainian soldiers burned an effigy of Trump, and that the FBI wiretapped Trump’s residence.
Iranian officials have also publicly vowed to avenge the assassination of Gen. Qasem Soleimani, who was killed in a U.S. strike in Iraq in January 2020, by going after the U.S. officials involved in that strike.
Most recently, earlier this week, a Pakistani man with connections to the IRGC was arrested after attempting to hire hitmen, really undercover agents, to carry out the assassination of unnamed government officials.
CLICK HERE TO READ MORE FROM THE WASHINGTON EXAMINER
Several former officials involved in the strike still have government-provided protection, while other lower-level officials do not.
In 2022, the Department of Justice unsealed charges accusing Shahram Poursafi, an Iranian national and IRGC member, of attempting to arrange the murder of former Trump national security adviser John Bolton, who was in that role when the Soleimani strike took place. Poursafi was accused of agreeing to pay an informant $300,000 to kill him, and the Iranian noted he had an additional “job” for the individual, which he’d pay a million dollars for the source to accomplish.