Microsoft exposes Iran’s attempts to influence 2024 US presidential election
As the US presidential election draws closer, Iran-linked groups are intensifying their efforts to influence the outcome, according to a new report from Microsoft.
As the US presidential election draws closer, Iran-linked groups are intensifying their efforts to influence the outcome, according to a new report from Microsoft.
The Microsoft Threat Intelligence Report, released on Friday, details how these groups have been setting up and launching influence campaigns aimed at swaying voters, particularly in swing states, while also conducting operations to gather intelligence on political campaigns, potentially laying the groundwork for future interference.
The report revealed that an Iranian group named Storm-2035 has launched covert news sites targeting both left-leaning and conservative US voters, using AI to plagiarize content and promote divisive political messages.
Another group called Sefid Flood has been preparing since March for potentially extreme influence operations, including “intimidation or inciting violence against political figures,” aiming to incite chaos, undermine authorities, and sow doubt about election integrity.
IRGC-linked hackers targeting senior officials before US election
Moreover, Microsoft reported that Mint Sandstorm—a group run by the Islamic Revolutionary Guard Corps (IRGC) intelligence unit—attempted to hack the account of a senior US official involved in a presidential campaign.
The incident involving what Microsoft called a “high ranking official” happened in June, just weeks after a breach discovered on the account of a county-level US official.
"A group run by the IRGC intelligence unit sent a spear-phishing email to a high-ranking official of a presidential campaign” and “another group with assessed links to the IRGC compromised a user account with minimal access permissions at a county-level government,” the report said, directly naming Iran.
Additionally, in May, Peach Sandstorm—another group linked to the IRGC—compromised the account of "a county-level government employee in a swing state." Microsoft noted that this group has been active since September 2023, primarily targeting US government organizations in swing states.
US intelligence officials recently admitted that Iran had ramped up the use of clandestine social media accounts with the aim to use them to try to sow political discord before the polls.
Iran has denied the allegations, with a statement from the UN Mission in New York to Reuters saying that the country’s cyber capabilities were "defensive and proportionate to the threats it faces" and that it had no plans to launch cyber-attacks.
"The US presidential election is an internal matter in which Iran does not interfere," the mission told Reuters in response to the allegations in the Microsoft report.
Microsoft also noted that the latest incident is part of an increase in activity trying to glean intelligence on US political campaigns and attempting to target swing states.
The successful breach in May of a county-level employee's account, Microsoft said, was part of a "password spray operation" in which hackers use common or leaked passwords en masse until they can break into one. However, no other accounts were breached.
Another Iranian group had launched “covert” news sites, Microsoft added, using AI to lift content from legitimate sources in order to target US voters across the political spectrum. It named Nio Thinker, a left-leaning site, and a conservative site called Savannah Time, which both share similar formats but without any contact details.
The US intelligence warned in July that, in addition to Iran, Russia and China were also conducting clandestine operations ahead of the upcoming elections. The three "rogue" states have been recruiting people in the US to spread propaganda, though the Iranian government denies the allegations.
As the elections near, the US remains on high alert for Iranian attacks. The 2024 annual threat assessment warned that "ahead of the US election in 2024, Iran may attempt to conduct influence operations aimed at US interests, including targeting US elections, having demonstrated a willingness and capability to do so in the past."
The assessment noted that during the US election cycle in 2020, Iranian cyber actors obtained or attempted to obtain US voter information, sent threatening emails to voters, and disseminated disinformation about the election.
"The same Iranian actors have evolved their activities and developed a new set of techniques, combining cyber and influence capabilities, that Iran
could deploy during the US election cycle in 2024," the report added.
In the 2020 election campaign, the FBI reported that Iranian operatives impersonated members of the right-wing Proud Boys group as part of a voter intimidation effort. Two men were charged.
Later that year, Iranian hackers breached a website that a municipal government in the US used to publish election results, though the attackers were caught before carrying out any nefarious activity, US cybersecurity officials said.
As the campaign ramps up, on Wednesday, the US State Department identified six alleged Iranian officials accused of compromising industrial control systems used by American public utilities.
Offering a $10m reward for information on their identity and whereabouts, the US said the six officials are linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) and its Cyber-Electronic Command (IRGC-CEC).
One of the men named was Hamid Reza Lashgarian. head of the IRGC’s cyber-electronic command and a commander in the IRGC-Qods Force.
The suspects have also been linked to the hacking group CyberAv3ngers, which in October, publicly took credit for cyberattacks against Israeli PLCs.
It is part of an ongoing cyber-war launched by Tehran. In February, the US imposed sanctions on the same six individuals for their “deliberate targeting of critical infrastructure.”
A Treasury Department official condemned the attacks as “unconscionable and dangerous,” emphasizing that the US “will not tolerate such actions and will use the full range of our tools and authorities to hold the perpetrators to account.”
In April, the US imposed sanctions on four men and two companies accused of conducting cyber-attacks for the Iranian military. The US Treasury Department said they were involved in "malicious cyber-activity" to the benefit of Iran's Islamic Revolutionary Guards Corps' Cyber-Electronic Command (IRGC-CEC).
Under Secretary of the Treasury for Terrorism and Financial Intelligence, Brian E. Nelson, said: “Iranian malicious cyber actors continue to target US companies and government entities in a coordinated, multi-pronged campaign intended to destabilize our critical infrastructure and cause harm to our citizens."
State Department spokesman Matthew Miller also said in a statement that Washington “will not tolerate malicious cyber activities victimizing US companies”.
The US Justice Department and FBI simultaneously unsealed an indictment against the four men accusing them of participating in a coordinated hacking initiative starting around 2016 through to April 2021, targeting American firms and crucial government departments.
In June, Microsoft President Brad Smith revealed that the company detects around 300 million cyberattacks targeting its customers daily, with a majority originating from China, Iran, North Korea and Russia.
As Iran steps up its cyber war globally, cybersecurity firm Check Point revealed last month that the Iranian hacker group MuddyWater has expanded its operations to countries such as Azerbaijan, Portugal, Turkey, Saudi Arabia, and India, using newly developed malware.
International organizations, including the US Cybersecurity and Infrastructure Security Agency, have attributed MuddyWater to Iran's ministry of intelligence.
MuddyWater, also known as APT34 and OilRig, has been active for several years, focusing on cyber-espionage against private and governmental organizations in the Middle East and Western countries.
On July 31, Senator Tom Cotton (R-Arkansas) and Congresswoman Elise Stefanik (R-New York) sent a letter to Vice-President Harris, inquiring about her national security advisor, Philip H. Gordon, and his possible ties to Iran’s influence network in the US, known as the Iran Expert Initiative. This network was exposed in a joint investigation by Iran International and Semafor last September.
The letter from Cotton and Stefanik followed a similar letter by Senator Jim Risch (R-Idaho) and Congressman Michael McCaul (R-Texas) on July 30 to Secretary of State Anthony Blinken, expressing concerns about Iran's influence operations in the US and threatening to subpoena the State Department if it failed to respond to their May 6 requestregarding Robert Malley’s alleged sharing of classified documents.
These efforts to verify the relationship between Iran’s Expert Network and a senior advisors like Philip Gordon are part of a broader investigation that began in October 2023 and cannot be dismissed as mere partisan rabble-rousing.
Until the Cotton-Stefanik public letter, Gordon's career and influence were mostly unfamiliar to those outside Washington, DC. On August 2, 2024, Politico article offered some background on Gordon for European readers, yet it failed to offer a thorough account of his career and national security vision.
Gordon’s influence on Harris’s policy is evident in her televised remarks after meeting Prime Minister Benjamin Netanyahu on July 25, where she condemned the humanitarian crisis in Gaza and urged Israel to accept the US-backed ceasefire plan. This aligns with Gordon’s long-standing advocacy for de-escalation and multilateral engagement in the Middle East. However, skepticism persists around Gordon’s recent post on "X," where he reassured the public of Harris’s unwavering support for Israel against Iran and its proxies, reflecting doubts rooted in his extensive diplomatic history.
Given Harris's limited foreign policy experience before becoming vice president, intense scrutiny of Gordon's background is essential for both the press and politicians. Analysts viewed Harris as a “neophyte” in foreign policy as she prepared for the vice presidency. Over the past four years, Gordon likely offered the vice president strategic counsel and education on US diplomacy's nuances. Assessing how Gordon’s perspectives might have shaped Harris’s approach and how they might influence her policies if she becomes president—and potentially appoints him as her national security advisor, a role not requiring Senate confirmation—is vital.
Understanding Gordon’s extensive intellectual and diplomatic career requires piecing together his various roles, interviews, articles, op-eds, and books, as no comprehensive biography of his exists. This thorough examination is essential to grasp his current national security stance, which notably aligns with pro-Iran “engagement” and “incentives” advocates.
Philip H. Gordon: From a Europeanist to an expert on Middle East
Philip H. Gordon is a distinguished diplomat and scholar, a European languages polyglot, with a PhD from Johns Hopkins University (1991) on Gaullist Legacy and France’s Security Diplomacy (1993). Known for his mild-mannered demeanor, Gordon has held key diplomatic roles under Presidents Clinton, Obama, and Biden. Unlike many diplomats who maintain a nonpartisan approach, Gordon is noted for his strong partisan alignment in foreign policy. This contrasts with figures like Victoria Nuland and Brett McGurk, who have served across party lines while maintaining a more neutral stance in their careers. For instance, McGurk, now serving as the White House’s Middle East Coordinator—a position Gordon once held under Obama—has worked under both Republican and Democratic presidents. He resigned in protest during the Trump administration, showcasing his commitment to his principles despite political pressures and accusations of "careerism."
Gordon acquired much of his expertise on the Middle East during his sabbaticals from the Bush and Trump administrations. In a 2004 interview promoting his book “Allies at War,” he argued against military confrontation with Iran and advocated for a mix of sanctions and incentives to encourage Iran's cooperation on its nuclear program. He also contributed to the “2005 US Compact with Europe,” which proposed a US commitment to allow EU investment in Iran in exchange for halting its nuclear fuel cycle. Mentioning Iran 24 times, the document can be seen as a precursor to shaping Obama's policy toward Iran. In his 2007 book “Winning the Right War,” Gordon proposed a “New Deal for the Middle East,” advocating withdrawal from Iraq and Afghanistan, an Arab-Israeli détente (distinct from Trump’s Abraham Accords), and engaging Iran through sanctions and incentives.
After Obama's election, Gordon served as Assistant Secretary of State for European and Eurasian Affairs from 2009 to 2013. The May 2010 National Security Strategy closely mirrors many ideas from Winning the Right War, particularly on engaging Iran, though it is not easy to fully assess his influence on the document.
During the Arab Spring and the Iran nuclear negotiations, Gordon was appointed Special Assistant to the President and White House Coordinator for the Middle East, North Africa, and the Gulf Region. While the specifics of his role in the 2013-2015 negotiations remain unclear, his expertise in European diplomacy, Middle Eastern affairs, and intelligence was probably helpful. Gordon excelled at processing piles of detailed daily briefings from the CIA, Pentagon, and State Department and was an effective liaison between the White House and negotiators in Oman and Vienna, leveraging long-standing relationships with key figures like Anthony Blinken and Rob Malley; his colleagues and soccer buddies from the late 1990s. His policy recommendations on Iran, outlined in Winning the Right War, influenced the November 25, 2013, “Joint Plan of Action,” which later became the framework for the 2015 Iran nuclear deal(JCPOA).
During his busy sabbatical from government service, Gordon researched and authored "Losing the Long Game: The False Promise of Regime Change in the Middle East" (Macmillan, 2022), a work that mirrors the arguments and tone of his earlier book, "Winning the Right War." Revising US foreign policy from 1945 onwards, with specific emphasis on the confrontational approaches adopted by both the Bush and Trump administrations, "Losing the Long Game" underscores Gordon's concerns about "escalation," "American credibility," and the necessity of "engaging" with various Middle Eastern actors, regardless of their rogue status from the US perspective. The book in effect consolidates the vision previously articulated in "Winning the Right War," advocating for a more innovative foreign policy that emphasizes diplomatic engagement and de-escalation.
The similarities between the vision outlined in Gordon's "Losing the Long Game" and Biden’s 2022 National Security Strategy are striking. Both emphasize de-escalation and diplomatic engagement, contrasting sharply with Trump's confrontational approach to the Middle East. Gordon's vision, as detailed in "Losing the Long Game," aligns closely with the principles in Biden's strategy, highlighting the need to avoid unnecessary escalation and maintain American credibility through engagement.
When Biden assumed office in 2021, several Iranian Revolutionary Guards-affiliated national security strategists publicly discussed how Iran could exploit the Biden administration’s de-escalation approach, characterized by reluctance to confront Iran directly, to the advantage of the Islamic Republic.
Gordon's vision, as articulated in his writings and public statements, emphasizes diplomatic engagement and multilateralism. Gordon has been part of an exclusive group of advisors to "democratic" presidents. Judging by his writings before and after assuming high office, one can infer that he advocated for restraint and multilateral diplomacy over unilateral military intervention, particularly in the cases of Syria and Ukraine. However, this approach may overlook the possibility that hardline strategists within Iran's regime could interpret such diplomacy as a sign of weakness. Many observers argue that the U.S. withdrawal from Afghanistan, guided by a similar vision, was perceived by adversaries like Russia’s Putin and Iran’s Khamenei as a sign of American weakness. Historians, perhaps thirty years from now, may be able to establish from the archives the pivotal role Gordon played in shaping Obama’s response to key events such as Putin’s annexation of Crimea in 2014, or Obama’s strategy in addressing the rise of ISIS and Russia’s intervention in Syria, or Biden’s policy towards the Taliban and the regime in Tehran.
As Kamala Harris is now in a tight race with Donald Trump, the prospect of Philip H. Gordon becoming her administration’s national security advisor warrants scrutiny. The scrutiny over Gordon's connections and influence is amplified by the current political climate, with Kamala Harris's presidency a distinct possibility and the broader implications of U.S. foreign policy decisions in a volatile global landscape. Republican lawmakers' inquiries and demands for transparency reflect a broader concern about ensuring that U.S. national security policies are not unduly influenced by foreign entities, particularly those linked to adversarial regimes like the Islamic Republic of Iran.
Philip H. Gordon’s Work History
The country face severe power shortages every summer and gas shortages every winter. Each year, policymakers opt to cut industrial power to keep household lights on. The shortfall reaches up to 14,000 MW, or 20%, during the summer.
Iran International reported last month that due to high summer temperatures, Iran faces a huge energy deficit, but the situation has not improved since early July.
Industrialists argue that it is truly perplexing for energy policymakers to choose the easiest route of cutting power to factories and steel plants rather than developing infrastructure or purchasing electricity to meet the country’s shortfall. They question how policymakers plan to compensate for the lost production, cover the insurance and costs incurred by power outages, and address customer commitments and the financial losses due to production delays.
Hamidreza Ghaznavi, Secretary-General of the Entrepreneurs Association, reacting to the frequent power cuts, told Khabar Online on Thursday, "The Ministry of Industry, Mine, and Trade (Ministry of IMT) must resolve the power cuts affecting industries. However, there is no vocal support for the industrial sector."
Varied impact on different sectors
In response to how much current capacity is affected by power cuts, Ghaznavi noted, "Some industries have been shut down for two months. Others operate only at night, and some alternate between two weeks of operation and two weeks of shutdown." He explained that while different industries face varying challenges, the steel and textile sectors are particularly hard-hit. He stressed that although all manufacturers are struggling, these sectors are in worse conditions.
Policy failures and economic consequences
Ghaznavi criticized the Ministry of IMT for not sufficiently protecting production. He noted that reducing electricity consumption in the public sector could increase the supply to the industrial sector, but this approach has not been effectively implemented. He pointed out that there are many ways to reduce power consumption, such as implementing penalties, but these measures are not being enforced to prevent the deteriorating conditions in factories.
To prioritize residential energy needs, the government has imposed limits on energy supplies to the industrial sector, causing annual losses estimated at $6-8 billion.
Official statistics reveal that 13% of Iran's generated electricity is lost during transmission and distribution due to an outdated grid. Experts belive losses reach 30%. This loss is equivalent to the total electricity consumption of the steel industry, which generates export revenues. Moreover, many of Iran's power plants are inefficient gas or steam types. Rather than modernizing the grid or converting to more efficient combined-cycle plants, the government has opted for measures like adjusting office hours or imposing restrictions on industrial power supply.
Dire outlook for Iranian economy
Ghaznavi emphasized the dire situation, urging the Ministry of IMT to take more action on power cuts and support investments. He noted that a resolution was passed to encourage factories to adopt solar power and clean energy, but this has yet to be implemented. There has been little support for factories to transition to solar energy, and no immediate actions have been taken to facilitate this shift.
Despite the recurring power cuts to industries, the CEO of the Iran Power Generation, Transmission, and Distribution Company recently announced that the country’s electricity consumption demand reached an astonishing 79,872 megawatts, a record-breaking figure in Iran's electricity industry history. According to Mostafa Rajabi Mashhadi, only 128 megawatts shy of breaking the 80,000 megawatt mark, the figures are astonishing. This level of demand is equivalent to the electricity consumption of both Egypt and Spain combined.
Instead of addressing the fundamental energy imbalance, authorities have resorted to cutting off electricity and gas to industries—a short-term solution that fails to resolve the country's energy deficit. Ghaznavi stressed that people need jobs for their livelihoods, and factories need to operate to meet market demands. If prices rise due to shortages, those who have had reliable power might find themselves unable to afford necessities, he added.
The group led by Ibrahim Al-Hefl (الهِفل), from the ruling family of the Al Aqeedat tribe, which has received military support and training from Iran, carried out a sudden and coordinated attack against the SDF in areas like Abu Hamam in Al-Shaitat and Dhiban, resulting in casualties.
Iran’s support for this group includes advanced equipment and intensive training in secret bases, reflecting Tehran’s intention to strengthen its regional influence. At the same time, Deir Ezzor is experiencing widespread resentment toward the Syrian regime, Iranian, and Russian forces, prompting the local population to support the SDF despite earlier reservations.
The recent developments highlight the complexities of the Syrian conflict and the increasing involvement of external powers exacerbating humanitarian and political crises. The situation remains unstable, with the potential for either escalating violence.
The Role of Iran and Tribal Groups
Among these groups, Ibrahim Al-Hefl's faction stands out, having received substantial military support from Iran, including not only military training but also advanced equipment, enabling the group to carry out sophisticated and coordinated operations against the Syrian Democratic Forces (SDF).
These developments worsen the region's security, intensifying clashes between Al-Hefl's group and the SDF and destabilizing previously safe civilian areas. Iran's growing influence through these groups is also alarming some Arab countries, particularly Saudi Arabia, which sees this as a threat to its strategic and security interests. This situation underscores the need for urgent diplomatic solutions to manage rising tensions and secure long-term regional stability.
Iran's Strategic Preparations and Timing
Iran has long recognized the importance of local Sunni Arab tribes in Syria to bolster its influence in the region. Consequently, it has worked to attract and direct these tribes to achieve its goals. Iran's cultivation of loyalty within this tribe has further complicated the Syrian conflict and provided Tehran with a stronger foothold in the region.
The Iranian Revolutionary Guard Corps (IRGC), known for its advanced training capabilities, has provided intensive training to Al-Hefl's group. This training covered unconventional warfare tactics, the use of advanced weapons, and espionage and reconnaissance techniques. Members of the tribe were trained in secret bases within Syria and sometimes in Iran, making them an effective combat force capable of conducting complex operations against Iran's adversaries in Syria, local sources claimed.
IRGC and its proxies occupy the western side of the Euphrates River, while the SDF and US forces are stationed within a few kilometers of its eastern banks. Al-Helf’s group are therefore very close to US forces and pose a serious danger.
Iran's support for Al-Hefl's group is part of a broader strategy aimed at enhancing its influence in that part of Syria and countering its opponents. By supporting these groups, Iran aims to pressure US forces and undermine their efforts. Furthermore, Iran seeks to use these groups as leverage in future negotiations, particularly concerning its conflict with Israel. The military operations conducted by these groups also serve to distract and strain the resources of Iran's adversaries.
The Attack on SDF and Iran's Role
The attack on the SDF can be described as sudden and well-coordinated. It began in the morning, targeting SDF positions in areas such as Abu Hamam in Shu'aytat, Al-Dhiban (Al-Hefl's hometown), and the city of Al-Busayrah, all of which are located east of the Euphrates River. Al-Hefl's group used advanced tactics and weapons. The attack was a clear message from Iran and its allies, demonstrating their ability to deliver significant blows at any time and place and their willingness to use force to achieve their objectives.
The Role of Ibrahim Al-Hefl and Syrian Regime Involvement
Ibrahim Al-Hefl, who played a prominent role in leading the tribe, has been absent from the current scene for unknown reasons, raising many questions. He was considered an influential figure in the region and had a significant impact on the tribe's military role. His absence has led to speculation as to whether it is due to internal tribal pressures or external intervention.
The Syrian regime's role in supporting and training Al-Hefl's group cannot be overlooked. Figures like Hashim Al-Sattam, a security officer with the regime, played a significant role in funding and providing logistical and training support to the group and others. Through these alliances, the Syrian regime aims to bolster its influence and exploit the ongoing conflict to achieve political and military gains. The collaboration between the Syrian regime and Iran in this context reflects the intertwined interests and objectives of both parties in confronting their common adversaries.
IRGC's strategy of planting cells
The IRGC's strategy in the Middle East is one of the key factors shaping the current developments of the conflict in Syria. This strategy focuses on enhancing Iranian influence by supporting militias and supplying them with weapons and training, thereby increasing their capability to execute Iran's regional objectives. These weapons include anti-aircraft weapons and RPGs, enabling militias to conduct effective offensive operations against the SDF and the international coalition.
Iran targets the international coalition through this combination, aiming to undermine the operations of the US-led coalition in the region. Part of this strategy involves equipping militias to target coalition helicopters, requiring special equipment and advanced training. Iran supplies militias with guided missiles and anti-aircraft systems, reflecting its intent to weaken the coalition's military presence in Syria and enhance its capacity to conduct sophisticated offensive operations.
Iran's Agendas
Hashim Al-Sattam's role in Al-Dhiban serves as an indicator of the increasing role played by Iran-supported groups in areas previously under opposition control. This indicates the subjugation of these areas to the Iranian regime, enhancing its ability to impose control and achieve its strategic objectives in the region. This presence also reflects how Iran uses local militias as tools to achieve its regional interests. For over a year, Iran has been preparing cells in Syria to attack the SDF.
In addition to supporting Syrian militias, Iran also equips and arms Iraqi cells operating under tribal groupings. These cells are used to achieve the same strategic goals in the region, as Iran seeks to expand its influence through multiple local alliances. Equipping these cells includes providing them with advanced weapons and special training, enhancing their capability to conduct offensive operations against coalition forces and other targets in the region.