Similar Posts
WASHINGTON – The accused Iranian hacking group who intercepted Republican U.S. presidential candidate Donald Trump’s campaign emails have finally found some success in getting their stolen material published after initially failing to interest the mainstream media.
In recent weeks, the hackers began peddling Trump emails more widely to one Democratic political operative, who has posted a trove of material to the website of his political action committee, American Muckrakers, and to independent journalists, at least one of whom posted them on the writing platform Substack. The latest material shows Trump campaign communications with external advisers and other allies, discussing a range of topics leading up to the 2024 election.
The hackers’ activities tracked by Reuters provide a rare glimpse into the operations of an election interference effort. They also demonstrate Iran remains determined to meddle in elections despite a September U.S. Justice Department indictment accusing the leakers of working for Tehran and using a fake persona.
The indictment alleged that an Iranian-government linked hacking group, known as Mint Sandstorm or APT42, compromised multiple Trump campaign staffers between May and June by stealing their passwords. In a Homeland Security advisory published earlier this month, the agency warned that the hackers continue to target campaign staff. If found guilty, they face prison time and fines.
The Department of Justice indictment said the leakers were three Iranian hackers working with Iran’s Basij paramilitary force whose voluntary members help the regime to enforce its strict rules and to project influence. Attempts to reach the hackers identified by name in the indictment via email and text message were unsuccessful.
In conversations with Reuters, the leakers – who collectively use the fake persona “Robert” – did not directly address the U.S. allegations, with one saying “Do you really expect me to answer?!”
“Robert” is the same fake persona referred to in the U.S. indictment, according to FBI emails sent to journalists and reviewed by Reuters.
Iran’s mission to the United Nations said in a statement that reports of the country’s involvement in hacking against the U.S. election were “fundamentally unfounded, and wholly inadmissible,” adding that it “categorically repudiates such accusations.” The FBI, which is investigating Iran’s hacking activity against both presidential campaigns in this election, declined to comment.
David Wheeler, the founder of American Muckrakers, said the documents he shared were authentic and in the public interest. Wheeler said his goal was to “expose how desperate the Trump campaign is to try to win” and to provide the public with factual information. He declined to discuss the material’s origin.
Without making any specific references, the Trump campaign said earlier this month that Iran’s hacking operation was “intended to interfere with the 2024 election and sow chaos throughout our democratic process,” adding any journalists reprinting the stolen documents “are doing the bidding of America’s enemies.”
In 2016, Trump took a different position when he encouraged Russia to hack into Hillary Clinton’s emails and provide them to the press.
LEAK OPERATION
The leak operation started around July when an anonymous email account, [email protected], began communicating with reporters at several media outlets, using the Robert moniker, according to two people familiar with the matter. They initially contacted Politico, the Washington Post and the New York Times, promising damning internal information about the Trump campaign.
In early September, the accused Iranian hackers used a second email address, [email protected], in a fresh round of overtures, including to Reuters and at least two other news outlets, the two people familiar with the matter, said.
At the time, they offered research compiled with public information by the Trump campaign into Republican politicians JD Vance, Marco Rubio and Doug Burgum, all of whom were under consideration as Trump’s running mate.
The vice presidential reports were authentic, a person familiar with the Trump campaign told Reuters. Neither Politico, the Washington Post, the New York Times, nor Reuters published stories based on the reports.
New York Times spokesperson Danielle Rhoades Ha, said the newspaper only published articles based on hacked material “if we find newsworthy information in the materials and can verify them.”
In an email, the Washington Post referred Reuters to past comments made by its executive editor, Matt Murray, who said the episode reflected the fact that news organizations “aren’t going to snap at any hack” provided to them. A spokesperson for Politico said the origin of the documents was more newsworthy than the leaked material. Reuters did not publish this material because the news agency did not believe it was newsworthy, a spokesperson said.
Both AOL email accounts identified by Reuters were taken offline in September by its owner Yahoo, which worked with the FBI before the indictment to trace them to the Iranian hacker group, according to two people familiar with the investigation. Yahoo did not respond to a request for comment.
Before losing email access, Robert suggested reporters might need an alternate contact and offered a telephone number on the encrypted chat application Signal. Signal, which is more difficult to monitor by law enforcement, did not return messages seeking comment.
Some senior U.S. intelligence and law enforcement officials have said that Iran’s interference efforts this election cycle are focused on denigrating Trump as they hold him responsible for the 2020 American drone assassination of former Iranian military general Qassem Soleimani.
Thus far, the already-published leaks do not appear to have changed the public dynamics of the Trump campaign.
MUCKRAKERS
On Sept. 26, North Carolina-based American Muckrakers, began publishing internal Trump campaign emails. Active since 2021, the PAC has a history of publicizing unflattering material about high-profile Republicans. According to public disclosure reports, it is funded through individual, small-dollar donors from around the country.
On its website, American Muckrakers said the leaks came from “a source,” but, ahead of the publication last month, the group publicly asked Robert to get in touch. “HACKER ROBERT, WHY THE F DO YOU KEEP SENDING THE TRUMP INFORMATION TO CORPORATE MEDIA?” the group said in a post to X. “Send it to us and we’ll get it out.”
When asked whether his source was the alleged Iranian persona Robert, Wheeler said “that is confidential” and that he had “no confirmation of the source’s location.” He also declined to comment on whether the FBI had warned him that the communication was the product of a foreign influence operation.
In one example, Muckrakers published material on Oct. 4th purporting to show an unspecified financial arrangement with lawyers representing former Presidential candidate Robert F. Kennedy Jr. and Trump. RFK Jr. attorney Scott Street, said in an email to Reuters he could not speak publicly about the incident. Reuters confirmed the authenticity of the material.
Muckrakers subsequently published documents from Robert about two high-profile races. It included alleged campaign communication about North Carolina Republican gubernatorial candidate Mark Robinson and Florida Republican representative Anna Paulina Luna, both of whom were endorsed by Trump.
The exchange about Robinson concerned an attempt by Republican adviser W. Kirk Bell, to seek guidance from the Trump camp after the scandal over comments attributed to Robinson on a pornographic forum. Robinson has previously denied the comments. The other message came from a Republican adviser sharing information with the campaign about Luna’s personal life.
Robinson and Luna’s campaigns did not return messages seeking comment.
One of the few journalists contacted by Robert who did publish material was independent national security reporter Ken Klippenstein, who posted the vice presidential research documents to Substack late last month. Robert confirmed to Reuters that they gave the material to Klippenstein.
Substack did not respond to a question about its policies concerning hacked material.
After the story, Klippenstein said FBI agents contacted him over his communication with Robert, warning that they were part of a “foreign malign influence operation.” In a post, Klippenstein said the material was newsworthy and he chose to publish it because he believed the news media should not be a “gatekeeper of what the public should know.”
A spokesperson for Reuters, which received similar notifications from the FBI, said, “We cannot comment on our interactions, if any, with law enforcement.” An FBI spokesperson declined to comment on its media notification effort.
Wheeler said he had new leaks in store “soon” and that he would continue to publish similar documents as long as they were “authentic and relevant.” REUTERS
A child in California has become the first in the United States to test positive for bird flu infection, authorities said on Nov 22, as health officials offered checks and preventive treatment to exposed contacts at the child’s day-care centre.
The child, from Alameda County in the San Francisco Bay area, had mild symptoms and was said to be recovering at home following treatment with flu antivirals, according to the US Centres for Disease Control and Prevention (CDC) and the California Department of Public Health (CDPH).
As a precaution, close family members of the child were tested, with all results coming back negative.
Local officials have also contacted caregivers and families at the day-care facility, where the child showed mild symptoms before testing positive.
Chinese hackers preparing for conflict, says US cyber official
Chinese hackers are positioning themselves in US critical infrastructure IT networks for a potential clash with the United States, a top American cybersecurity official said on Nov 22.
Ms Morgan Adamski, executive director of US Cyber Command, said Chinese-linked cyber operations are aimed at gaining an advantage in case of a major conflict with the US.
Officials have warned that China-linked hackers have compromised IT networks and taken steps to carrying out disruptive attacks in the event of a conflict.
Ukraine to step up air defence development after missile ‘test’
President Volodymyr Zelensky said on Nov 22 that Ukraine was working on developing new types of air defence to counter “new risks” following Russia’s deployment of a new medium-range missile in the 33-month war.
Mr Zelensky, in his nightly video address, said testing a new weapon for purposes of terror in another country was an “international crime” and issued a new call for a world-wide “serious response” to keep Russia from expanding the war.
He was speaking a day after Russia fired a new intermediate-range weapon – called Oreshnik (hazel tree) – into Ukraine for the first time. Ukraine said the missile reached a top speed of more than 13,000kmh and took about 15 minutes to reach its target from its launch.
Americans say you need a $364,000 salary to be ‘successful’
The price of success? About US$270,000 (S$364,000) a year.
That is the annual salary it takes to be considered financially successful, according to a survey released on Nov 22 by financial services company Empower. The hurdle for net worth is US$5.3 million, according to respondents.
Those numbers are well beyond the reach of most Americans.
New Ultimate Championship will be athletics ‘gamechanger’
World Athletics president Sebastian Coe said on Nov 22 the new Ultimate Championship team event, officially unveiled by the sport’s governing body, would be a “gamechanger” for track and field.
The inaugural event will be held in Budapest on Sept 11-13, 2026, and it will be staged every two years to fulfil World Athletics’ ambition of holding a global championship every year.
The federation said the event would provide “a spectacular conclusion to the summer athletics season, in the years where there is no World Athletics Championships”.
A breach of telecoms companies that the United States said was linked to China was the “worst telecom hack in our nation’s history – by far”, the chairman of the Senate Intelligence Committee told the Washington Post on Thursday.
Earlier this month, U.S. authorities said China-linked hackers had intercepted surveillance data intended for American law enforcement agencies after breaking into an unspecified number of telecom companies.
The hackers compromised the networks of “multiple telecommunications companies” and stole U.S. customer call records and communications from “a limited number of individuals who are primarily involved in government or political activity,” according to a joint statement released by the FBI and the U.S. cyber watchdog agency CISA on Nov. 13.
Beijing has repeatedly denied claims by the U.S. government and others that it has used hackers to break into foreign computer systems.
The Chinese embassy in Washington did not immediately respond to a request for comment from Reuters on Thursday night.
There were also reports Chinese hackers targeted telephones belonging to then-presidential and vice presidential candidates Donald Trump and JD Vance, along with other senior political figures, raising widespread concern over the security of U.S. telecommunications infrastructure.
“This is an ongoing effort by China to infiltrate telecom systems around the world, to exfiltrate huge amounts of data,” Mark Warner told the Washington Post.
The breach went further than the Biden administration has acknowledged, with hackers able to listen to telephone conversations and read text messages, Warner was cited as saying in a separate interview by the New York Times.
“The barn door is still wide open, or mostly open,” he told the publication. REUTERS
An Iranian hacking group is actively scouting U.S. election-related websites and American media outlets as election day nears, according to a new Microsoft blog published on Wednesday. Researchers say the activity suggests “preparations for more direct influence operations.”
The hackers – dubbed Cotton Sandstorm by Microsoft and linked to Iran’s Islamic Revolutionary Guard Corps – performed reconnaissance and limited probing of multiple “election-related websites” in several unnamed swing states, the report notes. In May, they also scanned an unidentified U.S. news outlet to understand its vulnerabilities.
“Cotton Sandstorm will increase its activity as the election nears given the group’s operational tempo and history of election interference,” researchers wrote. The development is particularly concerning because of the group’s past efforts.
Iran’s mission to the United Nations did not immediately respond to a request for comment. In recent past comments, they denied any involvement in 2024 election-related hacking activity.
In 2020, Cotton Sandstorm launched a different cyber-enabled influence operation shortly before the last presidential election. Posing as the right-wing “Proud Boys,” the hackers sent thousands of emails to Florida residents, threatening them to “vote for Trump or else!”.
The group also released a video on social media, purporting to come from hacktivists, where they showed them probing an election system. While that operation never affected individual voting systems, the goal was to cause chaos, confusion and doubt, senior U.S. officials said at the time.
Following the 2020 election, Cotton Sandstorm also ran a separate operation that encouraged violence against U.S. election officials who had denied claims of widespread voter fraud, Microsoft said.
The Office of the Director of National Intelligence, which is coordinating the federal effort to defend the election from foreign influence, did not immediately respond to a request for comment. REUTERS
SEOUL – Pro-Russia hacking groups have conducted cyberattacks against South Korea after North Korea dispatched troops to Russia to support its war against Ukraine, Seoul’s presidential office said on Friday.
The office held an emergency intra-agency meeting after detecting denial-of-service attacks on some government and private websites in recent days.
Some of the websites experienced temporary outages but there was no serious damage, it said, adding that the government will strengthen its ability to respond to such attacks.
“Cyber attacks by pro-Russian hacktivist groups on our country have occurred intermittently in the past, but have become more frequent since North Korea dispatched troops to Russia and participated in the Ukraine war,” the office said in a statement.
Seoul and Washington have said there are more than 10,000 North Korean soldiers in Russia, and U.S. officials and Ukraine’s defence minister said some of them have engaged in combat in Kursk, near the Ukraine border.
The new military cooperation between Pyongyang and Moscow has been condemned by South Korea, the United States and Western allies. Ukrainian President Volodymyr Zelenskiy said on Tuesday that the first battles between his country’s military and North Korean troops “open a new page in instability in the world.” REUTERS
MARYLAND – The director of the US National Security Agency on Nov 20 urged the private sector to take swift, collective action to share key details about breaches they have suffered at the hands of Chinese hackers who have infiltrated US telecommunications.
General Timothy Haugh, a four-star Air Force general who leads the NSA and Cyber Command, told Bloomberg News at the National Security Innovation Forum in Washington that public disclosure would help find and oust the hackers, as the US continues to try to understand a new spate of damaging mass breaches.
In calling for more disclosure, General Haugh didn’t identity specific companies.
General Haugh said he wants to provide a public “hunt guide” so cybersecurity professionals and companies can search out the hackers and eradicate them from telecommunications networks.
“The ultimate goal would be to be able to lay bare exactly what happened in ways that allow us to better posture as a nation and for our allies to be better postured,” he said, adding the US is reliant on industry to share insights into what happened on their own networks.
US authorities have confirmed Chinese hackers have infiltrated US telecommunications in what Senator Richard Blumenthal, a Connecticut Democrat, this week described as a “sprawling and catastrophic” infiltration. AT&T Inc, Verizon Communications Inc and T-Mobile are among those targeted.
Through those intrusions, the hackers targeted communications of a “limited number” of people in politics and government, US officials have said.
They include Vice-President Kamala Harris’ staff, president-elect Donald Trump and vice-president-elect JD Vance, as well as staffers for Senate Majority Leader Chuck Schumer, according to Missouri Republican Senator Josh Hawley.
Representatives of the Chinese government have denied the allegations.
China is “doing this on a scale en masse and as a national effort,” General Haugh said.
The US experience and response is more disjointed, given the limited reach of different law enforcement agencies and the dependence on information from the private sector. There are multiple investigations underway associated with the telecommunications breaches, he said.
“Everybody is in a slightly different place as it relates to Salt Typhoon,” General Haugh said, referring to Microsoft Corporation’s name for the group believed to be behind the telecommunications breaches.
Two cybersecurity experts who requested anonymity to speak freely have privately complained about the lack of information shared that could otherwise help them and others understand, find and tackle the hacks.
Detailed public disclosures would mean that even if some companies haven’t seen the intrusions yet, “they can begin to put countermeasures in place,” General Haugh said. It would also help other nations uncover and root it out too, General Haugh said.
“It’s going to take collective work,” he said, adding the “speed” with which everyone collaborates is a key step. BLOOMBERG