Microsoft: Iranian Hackers Targeted Email Accounts of Presidential Campaign, U.S. Officials

Microsoft: Iranian Hackers Targeted Email Accounts of Presidential Campaign, U.S. Officials

Over 200 accounts were targeted by the group of hackers, but only four were compromised, according to Microsoft.

A group of hackers believed to be linked to the Iranian government has targeted hundreds of email accounts, some of which are associated with an American presidential campaign, Microsoft announced Friday.

During a 30-day period in August and September, Microsoft’s threat intelligence recognized significant activity by a threat group they call Phosphorus. The hacking collective made more than 2,700 attempts to identify email accounts belonging to Microsoft customers and then targeted 241 of them. 

The accounts belonged to a range of public figures, including current and former government officials, journalists cover world politics, prominent Iranians who live outside of the country, and people working for a U.S. presidential campaign. Microsoft declined to identify the specific campaign. 

Of those accounts, the company said only four were compromised and that none of them belonged to the presidential campaign or government officials. All customers who were attacked have been notified, according to a blog posted by Tom Burt, Microsoft’s vice president of customer security and trust.

The hackers attempted to use password reset or account recovery features to take over some targeted accounts. Burt wrote that although the attacks were not “technically sophisticated,” the hackers attempted to use a significant amount of personal information to identify accounts belonging to their targets and then attempt to compromise them. 

“This effort suggests Phosphorus is highly motivated and willing to invest significant time and resources engaging in research and other means of information gathering,” Burt wrote. “As we’ve previously disclosed, our Digital Crimes Unit has also taken legal and technical steps to combat Phosphorus attacks and we continue to take these types of actions.” 

Chris Krebs, who serves as the director of the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, told NBC News that the government was trying to understand the severity of the attack. 

"While much of this activity can likely be attributed to run-of-the-mill foreign intelligence service work, Microsoft’s claims that a presidential campaign was targeted is yet more evidence that our adversaries are looking to undermine our democratic institutions,” Krebs said. 

The company said that it was sharing the attack for two reasons: to be more transparent about attacks that intend to disrupt democratic processes, and to encourage better cybersecurity practices by public figures in the government and media. 

“Publishing this information should help others be more vigilant and take steps to protect themselves,” Burt wrote. 

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Live From ISC West 2023 Preview

    ISC West 2023 is right around the corner! This year’s trade show is scheduled from March 28–31 at the Venetian Expo in Las Vegas, Nevada. The Campus Security & Life Safety and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Read Now

    • Industry Events
    • ISC West
  • A Break from Routine

    It was three years ago right about now that COVID was bringing the world to its knees. In mid-March of 2020, the president put travel restrictions on all flights in and out of Europe, the NBA suspended its season, and Tom Hanks announced that he’d tested positive for the disease—all in the same night. It was officially a national emergency two days later. Read Now

    • Industry Events
    • ISC West
  • Until We Meet Again

    A short three years ago we were all pondering whether to attend any tradeshows all thanks to COVID-19. Sorry to bring that nightmare up again, but it seems that little pandemic is in the rear-view mirror, and it’s time to meet again. Read Now

    • ISC West
  • Cyber Hygiene: What it Looks Like for IoT Devices

    Cyber Hygiene: What it Looks Like for IoT Devices

    For our second pillar about the Industrial Internet of Things (IIoT) Pillars of Security, we are going to discuss what cyber hygiene looks like for IoT devices. Read Now

Featured Cybersecurity

New Products

  • Dahua 2-Wire IP Video Intercom System

    Dahua 2-Wire IP Video Intercom System

    Dahua Technology is introducing a new line of expandable 2-wire IP video intercom solutions for the North America market. The New 2-wire IP video intercom is more advanced, cost effective, and designed to help businesses increase their security. 3

  • SecureAuth

    SecureAuth

    The acceleration of digital transformation initiatives as a result of COVID-19 has created a lasting impact on how businesses empower their workforce and engage customers. 3

  • SAFR® from RealNetworks

    SAFR® from RealNetworks

    A unique feature in SAFR version 3.4 is its ability to automate alerts to security personnel when a spoofing attempt or a fraudulent attempt to gain access is detected. 3