Google confirms Iran targeted U.S. presidential campaigns

The company’s Threat Analysis Group on Wednesday reported that the Iran-sponsored cyber group APT42 targeted both major U.S. presidential campaigns. Earlier this summer, APT42 bombarded the personal email accounts of campaign staff for former President Donald Trump and President Joe Biden—back when he was still running for office, Google said. Iranian officials denied hacking into presidential campaigns in the United States earlier this week, Iran’s state-run IRNA news group reported.

What do these attacks look like? APT42 sends malicious links, either in the body text of emails or embedded in otherwise benign PDF documents, Google explained. The company also observed Iranian hackers luring individuals to login pages for bogus video-call meetings. Iranian hackers also sent the phishing targets links to convincing fakes of Skype, Google Meets, OneDrive, and Dropbox, Google said.

Who are these attacks targeting? Google observed Iranian hackers trying to break into roughly a dozen personal email accounts of campaign members, former government officials, and other individuals affiliated with the campaigns. The company blocked many of the attempts but APT42 at other times successfully breached accounts, the company said.

Iranian hackers earlier this summer compromised a high-profile political consultant’s Gmail account, the company said. Google quickly shut down the account and reported the incident to law enforcement. Microsoft also reported last week that Iranian hackers successfully breached a presidential campaign. Google credited those successful attacks to APT42.

Are these attacks continuing? Yes, Iranian hackers continue attacking the email accounts of individuals associated with Vice President Kamala Harris, President Biden, and former President Trump, Google said.

Dig deeper: Read my report in The Sift about how Iran denies allegations it was involved in the cyberattack on the Trump campaign.