Google says Iran-backed hacking group APT42 has targeted the Trump and Biden campaigns, as well as Israeli military, government, and diplomatic organizations
The Trump and Biden campaigns, along with the named Israeli organizations, face an immediate need to assess phishing, account-security, and communications exposure associated with APT42’s reported activity.
Google’s attribution makes APT42 a more explicit risk category for the affected organizations and the security teams supporting them; the report does not establish a compromise.
Second-order effects
Campaign staff, political advisers, and government contacts become higher-priority targets for social-engineering defenses, since targeting reported across campaigns and administration-affiliated people can reach the broader networks around candidates.
Major platforms and security providers face pressure to coordinate detection and takedown work across email, messaging, and other channels as the same actor is reported by more than one company.
Third-order effects
If repeated targeting continues, election security will increasingly be treated as a cross-platform identity and communications-security problem, rather than a risk limited to campaign infrastructure.
The pattern points to persistent state-linked espionage against political and diplomatic ecosystems, making public attribution and platform cooperation more central to cyber deterrence even when intrusions are not confirmed.
The trend: State-linked groups are broadening political espionage from individual campaigns to the wider communications networks around governments, administrations, and diplomatic institutions.
🆕🚨 analysis from @Google on APT42 activity against 🇺🇸 and 🇮🇱. A ton of work from folks over the past few months dedicated to protecting users disrupting campaigns, and making life hard for the actors. More to come! https://blog.google/...
@kenklippenstein
Ken Klippenstein on x
Google links Iran's alleged hacks of Trump and Biden campaigns to tensions between Iran and Israel. “As hostilities between Iran and Israel intensify, we can expect to see increased campaigns,” Google's Threat Analysis Group concludes. [image]
@dnvolz
Dustin Volz on x
Google's security teams say they saw a hacking group linked to Iran's IRGC target in May and June the personal email accounts of “roughly a dozen individuals” affiliated with Biden and Trump, including current and former officials and campaign staffers. https://blog.google/... [i…
@levitt_matt
Matthew Levitt on x
You know you're doing something right when the bad guys target you. Here @google's Threat Analysis Group highlights Iranian #APT42 targeted credential phishing efforts masquerading as @WashInstitute. I'm one of the TWI researchers whose email they tried to spoof [image]
@a_greenberg
Andy Greenberg on x
Following news that the Trump campaign says it was hacked by Iran, Google now says one group working for Iran's Revolutionary Guard Corps has targeted both campaigns, going after a dozen individuals associated with Trump and Biden in May and June. https://www.wired.com/...
@ericgeller
Eric Geller on x
Google says it has thwarted Iranian government hackers' “small but steady” campaign to breach presidential campaigns, including attacks on personal accounts. Iran got into a Gmail account belonging to “a high-profile political consultant.” (Roger Stone?) https://blog.google/... […
@shashj
Shashank Joshi on x
“In the past six months, the U.S. and Israel accounted for roughly 60% of [IRGC] APT42's known geographic targeting, including the likes of former senior Israeli military officials and individuals affiliated with both U.S. presidential campaigns” https://blog.google/... [image]
@shashj
Shashank Joshi on x
“APT42 masqueraded as the legitimate Washington Institute for Near East Policy [@WashInstitute] in multiple campaigns since April 2024, targeting Israeli diplomats and journalists, researchers at U.S. think tanks, and others.” https://blog.google/...
r/stupidpol
r on reddit
Google confirms that Iranian hackers have stepped up targeting of both US presidential campaigns.
r/technology
r on reddit
A Single Iranian Hacker Group Targeted Both Presidential Campaigns, Google Says