Iranian hackers targeted 2020 presidential campaign, Microsoft finds

Hackers linked to the Iranian government have targeted the campaign of at least one 2020 presidential contender, Microsoft announced today in a blog post.

The technology giant also witnessed "significant" digital activity by the group, which it dubbed "Phosphorous," against current and former U.S. government officials, journalists covering global politics and prominent Iranians living outside of Iran.

On Friday afternoon, Reuters reported that anonymous sources said Iranian hackers attempted to infiltrate President Donald Trump's reelection campaign.

But Tim Murtaugh, communications director for Trump's campaign, told POLITICO "we have no indication that any of our campaign infrastructure was targeted."

Senior intelligence officials have warned that the upcoming election will be targeted not just by Russian hackers, but face possible interference by Iran and China. In July, Microsoft reported that Russian and Iranian hackers had carried at least 800 cyberattacks on political organizations.

In a 30-day period between August and September, Phosphorous made more than 2,700 attempts to identify consumer email accounts belonging to specific Microsoft customers and then attack 241 of those accounts, according to the company.

Four accounts were successfully hacked, but none of them were associated with a presidential campaign, or current or former U.S. official.

“It is important that we all — governments and private sector — are increasingly transparent about nation-state attacks and efforts to disrupt democratic processes,” said Tom Burt, Microsoft's vice president of customer security and trust.

On Tuesday, the Democratic National Committee sent an email advisory to Democratic presidential campaigns informing them about Microsoft’s discovery.

The hackers have been “attacking personal as well as official work accounts,” according to a copy of the message obtained by POLITICO. “They create believable spear phishing emails and fake LinkedIn profiles as primary tactics.”

The committee stressed that Microsoft had witnessed the group circumvent two-factor authentication in some instances. The DNC also urged campaigns to review the security checklist it issued earlier this year.

In a statement, DHS Cybersecurity and Infrastructure Security Agency chief Chris Krebs said the organization is aware of Microsoft’s findings and is “working with them to assess and mitigate impacts.”

“While much of this activity can likely be attributed to run-of-the-mill foreign intelligence work, Microsoft's claims that a presidential campaign was targeted is yet more evidence that our adversaries are looking to undermine our democratic institutions,” he added.

Protecting the 2020 election “will require government and industry working together, taking collaborative, tangible actions to push back on the threats we face,” according to Krebs.