Iranian hackers, back at work since war, threaten to reveal more emails from Trump aides

Iran-linked hackers have threatened to disclose more emails stolen from US President Donald Trump’s circle, after distributing a prior batch to the media ahead of the 2024 US election.

In online chats with Reuters on Sunday and Monday, the hackers, who go by the pseudonym Robert, say they have roughly 100 gigabytes of emails from the accounts of White House Chief of Staff Susie Wiles, Trump lawyer Lindsey Halligan, Trump adviser Roger Stone and porn star-turned-Trump antagonist Stormy Daniels.

Robert raises the possibility of selling the material but otherwise does not provide details of their plans or the content of the emails.

US Attorney General Pam Bondi describes the intrusion as “an unconscionable cyber-attack.”

Iran’s mission to the United Nations does not return a message seeking comment. Tehran has in the past denied committing cyberespionage.

Robert materialized in the final months of the 2024 presidential campaign, when they claimed to have breached the email accounts of several Trump allies, including Wiles.

The hackers then distributed emails to journalists.

The US Justice Department in a September 2024 indictment alleged that Iran’s Revolutionary Guards ran the Robert hacking operation. In conversations with Reuters, the hackers declined to address the allegation.

After Trump’s election, Robert told Reuters that no more leaks were planned. As recently as May, the hackers told Reuters, “I am retired, man.”

But the group resumed communication after this month’s 12-day air war between Israel and Iran, which was capped by US bombing of Iran’s nuclear sites.

In messages this week, Robert said they were organizing a sale of stolen emails and wanted Reuters to “broadcast this matter.”

American Enterprise Institute scholar Frederick Kagan, who has written about Iranian cyberespionage, says Tehran’s spies are likely trying to retaliate in ways that do not draw more US or Israeli action.

“A default explanation is that everyone’s been ordered to use all the asymmetric stuff that they can that’s not likely to trigger a resumption of major Israeli/US military activity,” he says. “Leaking a bunch more emails is not likely to do that.”