Investigation: a hacking group linked to Iran's Islamic Revolutionary Guard Corps has targeted former members of the Trump and Biden administrations since 2022
Context & Ripple Effects
This investigation extends the Iran-linked campaign risk beyond active presidential campaigns: federal agencies had already publicly attributed attempted intrusions into the Trump and Biden-Harris campaigns to Iran in a joint attribution of the campaign hacking attempts.
It also complements Meta's finding that a small WhatsApp account cluster tied to an Iran-backed group targeted people affiliated with both administrations, showing that politically connected networks—not just formal campaign infrastructure—were in scope.
First-order effects
- Former Trump and Biden administration personnel become a documented target set, requiring them and the organizations around them to treat post-government accounts and contacts as part of the exposure surface.
- The finding gives U.S. security officials additional evidence that the alleged activity was sustained from 2022 rather than limited to a single campaign-season incident.
Second-order effects
- Campaigns, transition teams, and former-official networks are pushed to extend security coordination beyond current employees, since alumni can hold access, relationships, and politically valuable information.
- The broader target set reinforces the case for coordinated disruption by platforms and government agencies; Meta had already identified Iran-linked WhatsApp targeting of administration affiliates.
Third-order effects
- If this pattern persists, the political attack surface will be defined less by an official campaign boundary and more by long-lived networks of advisers, alumni, and former officeholders.
- Repeated public attribution and subsequent law-enforcement action could make state-linked political hacking a more durable focus of cross-platform and federal cyber defense, though deterrent effects remain uncertain.
The trend: This is one data point in the expansion of state-linked political cyber operations from campaign systems to the wider ecosystem of influential former officials and advisers.