Iranian hackers charged with interfering in Trump campaign, stealing info, disseminating it to media

Three Iranian nationals have been charged by the Department of Justice with hacking the Trump presidential campaign and leaking it to the media.

Masoud Jalili, 36, Seyyed Ali Aghamiri, 34, and Yaser Balaghi, 37, were said to have been employed by the Islamic Revolutionary Guard Corps (IRGC) and have been hit with a slew of charges, including unauthorized access to computers to obtain information from a protected computer, conspiracy to provide material support to a designated foreign terrorist organization, eight counts of wire fraud while falsely registering domain names, and eight counts of aggravated identity theft, according to the Department of Justice. The IRGC was designated a terrorist organization in the US in 2019.

Jalili, Aghamiri, and Balaghi, starting in January 2020, were alleged to have begun carrying out a "wide-ranging hacking campaign that used spearphishing and social engineering techniques to target and compromise victims’ computers and accounts." The group used, among other things, virtual private networks and servers to obscure their locations, fake email accounts in the names of prominent international institutions and US persons, and created fake login pages to collect account credentials. The DOJ noted that some of these efforts were successful, while others were not. 

According to the Associated Press, targets of the operation included the Trump campaign as well as a former ambassador to Israel, a former CIA deputy director, a former US homeland security advisor, officials at the departments of State and Defense, and journalists.

The DOJ said that the hackers allegedly turned their attention towards the Trump campaign in May of 2024, using some of the same hacking infrastructure previously used to target other officials. The group was said to have successfully gained access to personal accounts of people affiliated with the campaign, including campaign officials.

"The conspirators used their access to those accounts to steal, among other information, non-public campaign documents and emails (campaign material)," the DOJ said.

Later, they allegedly sent or forwarded an email to three people believed to be with Biden’s presidential campaign when he was still in the race.  On June 27 they sent an email to two respondents containing "campaign material stolen from an official for US Presidential Campaign 1." Neither recipient responded. Another email was sent on July 3 to the third person, and they also did not respond.

Other stolen campaign materials regarding Trump’s possible VP picks were sent to "multiple members of the news media, in an attempt to induce the news media to publish the material." One such email read, "I think this information is worth a good [US news publication] piece with your narration. Let me know your thoughts."

“The Justice Department is working relentlessly to uncover and counter Iran’s cyberattacks aimed at stoking discord, undermining confidence in our democratic institutions, and influencing our elections,” said Attorney General Merrick Garland. “The American people – not Iran, or any other foreign power – will decide the outcome of our country’s elections.”

"Today’s charges represent the culmination of a thorough and long-running FBI investigation that has resulted in the indictment of three Iranian nationals for their roles in a wide-ranging hacking campaign sponsored by the Government of Iran," said FBI Director Christopher Wray. "The conduct laid out in the indictment is just the latest example of Iran’s brazen behavior. So today the FBI would like to send a message to the Government of Iran – you and your hackers can’t hide behind your keyboards."