Cyberwarfare / Nation-State Attacks
,
Election Security
,
Fraud Management & Cybercrime
POLITICO Source ‘Robert’ Shares Reports on VP Picks; Campaign Blames Iran
A campaign official for former President Donald Trump confirmed Saturday that an unknown hacker stole sensitive documents including reports created to vet Trump’s vice presidential nominees. The campaign blamed Iranian election meddling, but provided no evidence for the claim.
See Also: Critical Infrastructure Cybersecurity & Risk Monitoring: Elections Infrastructure
POLITICO reported Saturday that an anonymous source has been sharing internal Trump campaign documents with the news organization for weeks. “On July 22, POLITICO began receiving emails from an anonymous account. Over the course of the past few weeks, the person – who used an AOL email account and identified themselves only as “Robert” – relayed what appeared to be internal communications from a senior Trump campaign official,” POLITICO said.
In response to questions by POLITICO, a Trump campaign spokesman confirmed the breach and implied that Iranian hackers were responsible, citing a Microsoft report on Friday about election meddling by foreign adversaries.
“These documents were obtained illegally from foreign sources hostile to the United States, intended to interfere with the 2024 election and sow chaos throughout our Democratic process,” Cheung said. “On Friday, a new report from Microsoft found that Iranian hackers broke into the account of a ‘high ranking official’ on the U.S. presidential campaign in June 2024, which coincides with the close timing of President Trump’s selection of a vice presidential nominee.”
Microsoft said several Iranian nation-state groups are stepping up attacks related to election influence. Microsoft said Mint Sandstorm, which is run by the Islamic Revolutionary Guard Corps intelligence unit, sent a spear-phishing email to a high-ranking official of a presidential campaign from a compromised email account of a former senior advisor. The security team said it notified the targeted officials.
“The phishing email contained a fake forward with a hyperlink that directs traffic through an actor-controlled domain before redirecting to the listed domain,” said Microsoft, adding that the group, also known as Charming Kitten, unsuccessfully tried to log in to the account of a “former presidential candidate” on June 13, just prior to the phishing attempt.
The attack also occurred only weeks after the same group successfully compromised the account of a county-level official in a swing state – although the incident may have been part of a broader password spray operation unconnected to Tehran election influence operations.
“Regardless of the intent, this targeting is a reminder that senior policymakers should be cognizant of monitoring and
following cybersecurity best practices even for legacy or archived infrastructure, as they can be ripe targets for threat actors seeking to collect intelligence, run cyber-enabled influence operations, or both,” Microsoft advised. The report also included examples of election influence by nation-state groups in Russia and China.
After the attempted assassination of Trump at a campaign rally July 13, campaign officials warned that Iran was plotting to kill the former president for ordering the 2020 drone strike that killed Qasem Soleimani, the top general in Iran’s IRGC. An Iranian official denied that allegation calling it “malicious.”
“The Iranians know that President Trump will stop their reign of terror just like he did in his first four years in the White House,” Cheung said in a report by The Hill.
POLITICO did not say whether it plans to release the reports from the anonymous source, describing the document on GOP vice presidential nominee JD Vance as a 271-page “research dossier” based on “publicly available information about Vance’s past record and statements, with some – such as his past criticisms of Trump – identified in the document as “POTENTIAL VULNERABILITIES.” The source also sent a portion of a research document about U.S. Sen. Marco Rubio, R-Fla., a top contender for Trump’s vice presidential pick.
The leak raises questions about the media’s role in election influence campaigns led by foreign adversaries. Trump famously publicly called on Russia to hack rival Hillary Clinton’s for deleted emails. Subsequently, hackers phished Clinton campaign manager John Podesta and stole thousands of emails including embarrassing details about the campaign and its conflicts with Democratic rival Bernie Sanders, which were later leaked to the media just prior to the election. The Russian phishing attack, later confirmed by federal investigators, led to a special counsel investigation into Russian election interference and resulted in multiple indictments against Russian threat actors linked to the country’s intelligence service.
But the Trump spokesman said the media should refrain from publishing stolen campaign information. “Any media or news outlet reprinting documents or internal communications are doing the bidding of America’s enemies and doing exactly what they want,” Cheung said.
A National Security Council spokesperson told CBS News Saturday that it will defer to the Justice Department on the matter, and that the “Biden-Harris Administration strongly condemns any foreign government or entity who attempts to interfere in our electoral process or seeks to undermine confidence in our democratic institutions.”
POLITICO said is doesn’t know who the source is and when the news organization asked how “Robert” obtained the documents, “the person responded: ‘I suggest you don’t be curious about where I got them from. Any answer to this question, will compromise me and also legally restricts you from publishing them.’”