Google said in a research report Wednesday that it detected efforts by Iranian hackers to target both the Trump and the Biden-Harris campaigns in May and June, part of a larger email phishing operation that still persists.
Google’s announcement adds credence to the Trump campaign’s claim Saturday that it had been hacked as part of an Iranian campaign to interfere with the election.
In its report, Google’s Threat Analysis Group, which tracks government-backed cyberattacks, said it had disrupted a “small but steady” phishing operation from a hacking unit tied to the Islamic Revolutionary Guard Corps.
In May and June, “targets included the personal email accounts of roughly a dozen individuals affiliated with President Biden and with former President Trump, including current and former officials in the U.S. government and individuals associated with the respective campaigns,” Google said in its report. The company blocked “numerous” attempts to log in to the targets’ personal email addresses, it said.
Google said the hacking operation accessed the Gmail account of at least one high-profile political consultant in July. The company said it went on to secure the account and referred the matter to law enforcement. The company didn’t disclose the identity of the consultant or whether the consultant was involved with either campaign.
Like many elite government-affiliated hacking groups, the Revolutionary Guard hackers are known for their dogged persistence. Google said it “continues to observe” unsuccessful attempts to break into accounts affiliated with Biden, Vice President Kamala Harris and Trump.
The attempted hacks, part of a larger campaign to hack U.S. and Israeli targets, have used Google products like Sites, Drive and Gmail, Google said.
Reports of a credible hacking threat to U.S. presidential campaigns began last week, when Microsoft said hackers affiliated with the Revolutionary Guard had broken into the email account of a former senior adviser to a presidential campaign. Microsoft didn’t provide more details about who was hacked.
A spokesperson for Iran’s Mission to the United Nations didn’t immediately reply to a request for comment. Iranian state news previously reported that a representative for the mission had denied Iranian involvement in hacking Trump’s campaign.
Over the weekend, three U.S. news outlets — Politico, The Washington Post and The New York Times — said they had received emails including what appeared to be Trump campaign files in what appeared to be a “hack-and-leak” operation to embarrass Trump. The FBI said Monday it was investigating efforts to hack both the Trump and the Biden-Harris campaigns but didn’t provide further details.
Only the Trump campaign has claimed to have been hacked. The initial round of phishing emails this spring happened before Biden dropped out of the race and Harris became the Democrats’ nominee. A Harris official told NBC News the campaign was unaware of any security breach.
No major cybersecurity company or government agency has so far explicitly said that Iran successfully hacked the Trump campaign. Microsoft has declined to comment further on its report. A Microsoft spokesperson told NBC News its policy is to refrain from publicly disclosing details about a hacking victim unless that victim clearly asks it to.
The series of events comes after a U.S. intelligence official from the Foreign Malign Influence Center, one of the few arms of the U.S. government devoted to countering foreign propaganda campaigns, warned that Iran was likely to continue efforts to denigrate Trump.