Iranian hacker group focuses on US election websites and media ahead of vote, Microsoft says

An Iranian hacking group is actively scouting US election-related websites and American media outlets as election day nears, according to a Microsoft blog. Researchers say the activity suggests “preparations for more direct influence operations.”

The hackers – dubbed Cotton Sandstorm by Microsoft and linked to Iran’s Islamic Revolutionary Guard Corps – performed reconnaissance and limited probing of multiple “election-related websites” in several unnamed swing states, the report notes. In May, they also scanned an unidentified US news outlet to understand its vulnerabilities.

“Cotton Sandstorm will increase its activity as the election nears given the group’s operational tempo and history of election interference,” researchers write. The development is particularly concerning because of the group’s past efforts.

A spokesperson for Iran’s mission to the United Nations says that “such allegations are fundamentally unfounded, and wholly inadmissible.”

“Iran neither has any motive nor intent to interfere in the US election,” they add.

In 2020, Cotton Sandstorm launched a different cyber-enabled influence operation shortly before the last presidential election. Posing as the right-wing “Proud Boys,” the hackers sent thousands of emails to Florida residents, threatening them to “vote for Trump or else!”

The group also released a video on social media, purporting to come from hacktivists, where they showed them probing an election system. While that operation never affected individual voting systems, the goal was to cause chaos, confusion and doubt, senior US officials said at the time.

Following the 2020 election, Cotton Sandstorm also ran a separate operation that encouraged violence against US election officials who had denied claims of widespread voter fraud, Microsoft said.

The Office of the Director of National Intelligence, which is coordinating the federal effort to defend the election from foreign influence, did not immediately respond to a request for comment.