Federal prosecutors have unsealed the charges for three Iranian hackers that allegedly targeted members of Donald Trump’s presidential campaign as part of a broad cyberattack, according to the unsealed indictment.
The three men, identified as Masoud Jalili, Seyyed Ali Aghamiri, and Yasar Balaghi, are all members of Iran’s Islamic Revolutionary Guard Corps (IRGC). The indictment details a “wide-ranging hacking campaign” that used spearphishing and social engineering to compromise the accounts of U.S. government officials, media, NGOs, and people connected to U.S. political campaigns.
The 37-page indictment, issued by a grand jury in Washington, D.C., includes 18 counts, such as wire fraud, identity theft, conspiracy to support a terrorist organization, and hacking. The State Department quickly offered a $10 million reward for information on the defendants, while the Treasury Department imposed new sanctions on seven people linked to the Iranian hacking operations.
While the indictment does not specifically name the campaign, U.S. officials have indicated that the Trump campaign was the target. The indictment makes it clear that these Iranian efforts were aimed at undermining Trump’s re-election bid.
According to the indictment, the hackers began their campaign in 2020, following the U.S. drone strike that killed Iranian General Qassem Soleimani. The hackers shifted their focus to Trump’s political campaign in May 2024, using spearphishing emails to steal private documents and communications, which they attempted to leak to the media and individuals they believed to be associated with another campaign.
While the indictment does not name the other campaign, it appears to match the timeline of Biden’s campaign before he withdrew from the race. Both campaigns cooperated with the investigation, and there is no evidence the Biden campaign responded to the hackers.
The hackers, all based in Iran, are part of a paramilitary branch of the IRGC called the Basij. They are described as skilled operators who have previously targeted U.S. government officials, including those working in the White House, Pentagon, Justice Department, and CIA. They used advanced techniques, such as spoofed login pages and stolen multi-factor authentication codes, to access and steal data from U.S. targets.
By June 2024, the hackers had successfully accessed email accounts of two individuals associated with Trump’s campaign. They later contacted someone they believed was connected to the Biden campaign, stating their intention to help defeat Trump by sharing stolen materials. However, the recipient did not respond, and other attempts to reach out to Biden’s campaign went unanswered.
In July 2024, the hackers pivoted to targeting media outlets, attempting to leak stolen campaign material regarding potential vice presidential candidates.
Last week, intelligence agencies confirmed that Iranian hackers sent unsolicited emails containing stolen Trump campaign materials to people associated with Biden’s campaign. The hackers also continued their attempts to leak the stolen information to the media.
Iran has denied any involvement, with its U.N. mission stating it does not engage in U.S. electoral matters. However, the Trump campaign revealed it had been hacked, attributing the breach to Iranian actors who distributed internal documents to the press.
These actions are part of a broader pattern of Iranian hostility toward Trump and his associates following Soleimani’s death. Some former U.S. officials have been under increased protection due to threats against their lives. In July, prosecutors charged a Pakistani national with ties to Iran for plotting to assassinate U.S. officials, potentially including Trump.
Deputy Attorney General Lisa Monaco warned that as technology advances, more threat actors are joining the game of election interference, with the goal of undermining trust in the democratic process.
Read the indictment here.
