Loading story…
U.S. authorities investigated suspected Iranian cyber activity targeting the 2024 presidential race after Donald Trump’s campaign said it had been hacked and internal materials were leaked, including a vetting document on Sen. JD Vance. The FBI opened a national security investigation into attempts aimed at a Trump associate and advisers to the Biden-Harris campaign, while the Harris campaign said it had faced an unsuccessful spear-phishing attempt and found no evidence of a breach.
The activity fit a broader Iranian influence and intrusion effort tied to the election. Microsoft reported Iran-linked operators were using fake news sites and cyber operations to meddle in U.S. politics, and the White House condemned any foreign interference. The case later escalated from investigation to prosecution, with U.S. authorities charging Iranian operatives over the hacking of the Trump campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities charged Iranian operatives in connection with hacking the Trump campaign, escalating the matter from investigation to criminal action.
The Kamala Harris campaign said it had been targeted in an unsuccessful spear-phishing attempt and that it had detected no breach of its systems.
The FBI formally acknowledged that it had opened a national security investigation into suspected hacking attempts attributed to Iran targeting a Trump associate and advisers to the Biden-Harris campaign.
The Trump campaign said it was the victim of a foreign hack after internal campaign materials, including a document assessing JD Vance's vulnerabilities, were leaked.
Microsoft publicly described Iranian-linked activity aimed at interfering in the 2024 U.S. presidential election, including fake news sites and a June intrusion tied to the Trump campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourceusatoday.com
Open sourcewashingtonpost.com
Open sourcewashingtonpost.com
Open sourcenpr.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities tied Iran to a multi-stage influence operation aimed at the 2020 presidential election, including spoofed **Proud Boys** emails that threatened Democratic voters, theft of data from a misconfigured state voter system affecting more than **100,000** voters, and a disinformation video that falsely portrayed election infrastructure as compromised. FBI and CISA alerts said the actors used voter intimidation emails, spoofed media sites, propaganda, and infrastructure that included VPN-backed IP addresses, while warning that parts of the video appeared staged for psychological effect even though the operators were likely capable of exploiting common web vulnerabilities. The campaign continued after Election Day with the **"Enemies of the People"** website, which published personal information and death threats against election officials, security leaders, governors, and voting-system personnel who rejected fraud claims. The U.S. later charged **Seyyed Mohammad Hosein Musa Kazemi** and **Sajjad Kashian**, alleged contractors for Iran-linked **Emennet Pasargad**, and imposed sanctions on the company, other Iranian nationals, and IRGC-linked entities; separate Justice Department actions also seized dozens of domains allegedly used by the IRGC to run covert propaganda outlets targeting U.S. audiences.
Aug 15, 2026
US Cyber Command secretly targeted at least two Russian companies involved in covert online influence activity ahead of the 2024 US election, according to reporting that said the operation was part of a wider federal effort with the FBI, DHS, and other agencies to expose and disrupt foreign meddling aimed at voters in key swing states. The campaign reportedly pushed anti-Ukraine and anti-politician narratives, and officials said the US action slowed the Russian operation even though propaganda content continued through Election Day. The activity fits a longer pattern of Russian interference in US politics, following earlier US government findings that Moscow targeted election systems in 2016 and subsequent Justice Department charges against Russian individuals and companies tied to interference operations. Officials and former officials warn that many of the structures built after the 2016 election to counter foreign influence have since been dismantled, reduced, or paused, including functions at ODNI, the FBI, the State Department, and CISA. The rollback comes despite continued threats from Russian, Chinese, and Iranian-linked actors using fake websites, AI-enabled propaganda, and cyber activity affecting election infrastructure, raising concerns that the United States has less visibility and fewer coordinated defenses in place for future elections.
Jun 29, 2026
Iranian and North Korean state-linked hacking groups were reported using **journalist and think tank impersonation** to trick targets into surrendering credentials and sensitive information. Recorded Future said Iran’s `APT42`, tied to the Islamic Revolutionary Guard Corps, continued masquerading as media outlets and research organizations in espionage campaigns, while U.S. agencies and regional reporting described North Korea’s `Kimsuky`/`APT43` using fake reporters and policy experts to approach foreign policy specialists, officials, and other high-value targets. Google said `APT42` also targeted both the Trump and Biden/Harris presidential campaigns, along with Israeli military, government, and diplomatic organizations, in phishing operations that included current and former officials and campaign personnel. Microsoft and Google reported successful compromises linked to the activity, including access to a political consultant’s personal Gmail account and a campaign-related official through a hacked adviser’s email, while the FBI opened an investigation and providers said they blocked login attempts, warned victims, and coordinated with law enforcement.
Jun 29, 2026