Google alleged Wednesday that Iranian-backed attackers known for trying to compromise accounts of people with ties to former President Donald Trump were also targeting people close to President Biden and Vice President Kamala Harris.
The search engine giant warned that it expects the Iran-backed APT42 to step up cyber attacks amid rising tensions between Israel and Iran, with the group having already targeted dozens of government officials.
“APT42 is a sophisticated and persistent threat actor that shows no signs of stopping in its attempts to target users and deploy new tactics.” The tech giant wrote in a blog post:.
“This spring and summer, they demonstrated the ability to run multiple phishing campaigns simultaneously, with a particular focus on Israel and the United States,” Google added.
Last Saturday, the Trump campaign confirmed it had been the victim of an attack perpetrated by Iranian actors that Microsoft revealed without identifying the victims.
Includes multiple news organizations POLITICO and The Washington Post He claimed to have received documents from the Trump campaign that appeared to be part of the hack.
Specifically, the outlets claimed they had been sent 271 pages of documents that appeared to be reviewing material relating to Republican vice presidential nominee J.D. Vance.
It also includes a list of potential vulnerabilities for Trump and was prepared by Brand Woodward, a law firm that works for some of Trump’s advisers.
Microsoft did not mention APT42 He did not specify, but said Iranian groups with ties to the Islamic Revolutionary Guard Corps had sent spear phishing emails to election officials.
Google said APT42 is affiliated with the IRGC and is involved in phishing scams targeting accounts “related to the US presidential election.”
According to Google, the United States suffered 31% of APT42 attacks, while Israel endured the same percentage. Attacks against Israel appear to have spiked in April and May.
Google also claimed to have removed “an APT42-created Google Sites page” that was posing as “a petition from the Legitimate Jewish Institution for Israel calling on the Israeli government to enter into mediation to end the conflict.”
Iran has long been thought to be interested in sabotaging President Trump’s reelection chances, driven by a desire for revenge for ordering the attack that killed Iranian Gen. Qassem Soleimani in 2020 and Trump’s penchant for harsh sanctions against the regime.
Google confirmed that APT42 had also targeted Biden and Harris, but suggested its efforts were unsuccessful.
“Today, TAG [Google’s Threat Analysis Group] “We continue to observe failed attempts by APT42 to compromise accounts of individuals with ties to President Biden, Vice President Harris and former President Trump, including current and former government officials and campaign associates,” the search engine company wrote.
The company further explained that it had thwarted APT42 attempts to attack accounts associated with the Trump and Biden campaigns during the 2020 election cycle, and continues to do so again this year.
“APT42 targets in May and June included approximately a dozen personal email accounts associated with President Biden and former President Trump,” Google wrote.
The group’s tactics include distributing phishing links in emails to senior government officials and setting up fake, legitimate-looking websites to obtain information that will help them break into accounts.
Google noted that accounts that don’t implement multi-factor authentication are most vulnerable to these types of attacks.
In addition to hacking, Iran has been accused of backing plots to assassinate President Trump, including a recent federal charge brought against Asif Merchant, a 46-year-old Pakistani national, in New York City for plotting the assassination.
Trump was not named as a specific target in the court documents, but Attorney General Merrick Garland later confirmed that this was the case.
In 2021, the Director of National Intelligence Declassified An assessment that Iran targeted President Trump during the 2020 election.
“We assess that Iran conducted a multipronged, covert influence campaign aimed at undermining former President Trump’s reelection chances without directly supporting any rival,” the document reads. “We assess that Supreme Leader Ayatollah Ali Khamenei approved this campaign.”
Last month, the Office of the Director of National Intelligence Reiterating concerns over Iranian interference and He told reporters The committee said it had “not observed any change in Iran’s preferences” during the election. It did not elaborate on the alleged campaign against Trump.
Iran has publicly denied allegations of election interference.
