Iran will likely try to contact Americans directly in an influence campaign, sources say

U.S. officials expect Iran is likely to contact individual Americans directly in the coming weeks to try to influence how they vote, sow social division or incite violence, according to three sources with knowledge of U.S. intelligence reporting on the matter.

While it is unclear exactly what such an operation would entail, or even whether it has begun yet, the US, Swedish and Israeli governments have all accused Iran in recent years of sending threatening and intimidating email and text messages to to send their citizens. The US intelligence community noted this month that Iranian hackers appear to have gained access to the voting data of some Americans, as they did in 2020.

“You don’t have to read the tea leaves to know this is a possible tactic. They have a clear history of using it,” said John Hultquist, principal analyst at Google’s Threat Intelligence Group.

Last week, U.S. intelligence officials told reporters that both Iran and Russia continue propaganda operations to influence American voters and society. Russia would prefer former President Donald Trump to win while Iran would prefer him to lose, but both countries want to stoke distrust in democracy and could try to incite violence in the US before or after the election, the officials said.

Two ongoing cyber influence operations this election cycle that the US government and cybersecurity companies have blamed on Iran – a hack-and-leak operation to stealing and distributing campaign material from Trump’s campaign and a series of fake American news websites – have failed to gain traction. A spokesman for Iran’s mission to the United Nations did not respond to a request for comment, but Tehran officials have routinely denied U.S. accusations of election influence campaigns.

“There are two distinct goals that Iranian actors can pursue in direct outreach,” Max Lesser, a senior analyst at the nonprofit Foundation for Defense of Democracies, told NBC News. “You simply send the message directly to the intended target group. That is obviously much more direct and demonstrably more efficient than creating a fake website or creating a social media botnet, which we have seen often doesn’t get much engagement.”

“Secondly, they could also try to incite people to physical information operations, whether that’s vandalism, graffiti or things like that,” he said.

A partially edited intelligence memo of October 8, which the US made public last week, describes two ways in which Iranian military intelligence may have obtained additional personal data on American voters.

“As of August 2023, (redacted) Islamic Revolutionary Guard Corps (IRGC) actors were aware of unspecified information about U.S. voters in unnamed states that was available for download on a leak website, which, if obtained, would can be used to target voters with disinformation. the memo says.

“As of February, (redacted) IRGC cyber actors had accessed a network domain related to a U.S. state government’s election distribution and likely obtained data on voter registration and whether or not some of those registered had voted (redacted) ,” the report said. say.

Ahead of the 2020 election, US officials announced that Iran was behind an ambitious effort to sow electoral conflict. This was reported by the Ministry of Justice indictment a year later, employees of an Iranian government-linked technology company gathered some American voter information and sent threatening emails to registered Democrats in Florida, claiming to be members of the pro-Trump militia group the Proud Boys. Google said at the time that the hackers sent about 25,000 such emails via Gmail, but about 90% of them ended up in spam filters.

Last month, Israel accused Iran and Hezbollah of hacking a commercial messaging service to send 5 million harassing text messages to Israeli citizens. One of the texts read: “Say goodbye to your loved ones; but don’t worry. In a few hours you will hug them in hell,” the Israeli newspaper said Haaretz reported.

In 2023, activists in Sweden burned copies of the Quran, prompting strong condemnation from several Muslim-majority countries. A hacktivist group calling itself Anzu Team appeared on Telegram, vowing revenge, defacing some websites and offering rewards for information on the whereabouts of people allegedly involved in the fires.

“No government or private organization will be safe unless you hand over desecrators of the Holy Quran to Islamic society. The attacks will continue,” the group wrote on its Telegram channel, which is still visible although it has not posted since August last year.

Shortly afterwards, around 15,000 Swedes received mysterious text messages calling for violent revenge. Last month, The Swedish authorities have announced this they had concluded that the Anzu team was a front for the IRGC, which had sent the messages by breaking into a Swedish text messaging service. Iran denied the accusation.