The accused Iranian hacking group who intercepted Republican US presidential candidate Donald Trump's campaign emails have finally found some success in getting their stolen material published after initially failing to interest the mainstream media.
In recent weeks, the hackers began peddling Trump emails more widely to one Democratic political operative, who has posted a trove of material to the website of his political action committee, American Muckrakers, and to independent journalists, at least one of whom posted them on the writing platform Substack. The latest material shows Trump campaign communications with external advisers and other allies, discussing a range of topics leading up to the 2024 election.
The hackers' activities tracked by Reuters provide a rare glimpse into the operations of an election interference effort. They also demonstrate Iran remains determined to meddle in elections despite a September U.S. Justice Department indictment accusing the leakers of working for Tehran and using a fake persona.
The indictment alleged that an Iranian-government linked hacking group, known as Mint Sandstorm or APT42, compromised multiple Trump campaign staffers between May and June by stealing their passwords. In a Homeland Security advisory published earlier this month, the agency warned that the hackers continue to target campaign staff. If found guilty, they face prison time and fines.
The Department of Justice indictment said the leakers were three Iranian hackers working with Iran’s Basij paramilitary force whose voluntary members help the regime to enforce its strict rules and to project influence. Attempts to reach the hackers identified by name in the indictment via email and text message were unsuccessful.
In conversations with Reuters, the leakers - who collectively use the fake persona "Robert" - did not directly address the U.S. allegations, with one saying “Do you really expect me to answer?!”
"Robert" is the same fake persona referred to in the U.S. indictment, according to FBI emails sent to journalists and reviewed by Reuters.
Iran's mission to the United Nations said in a statement that reports of the country's involvement in hacking against the U.S. election were "fundamentally unfounded, and wholly inadmissible," adding that it "categorically repudiates such accusations." The FBI, which is investigating Iran’s hacking activity against both presidential campaigns in this election, declined to comment.
David Wheeler, the founder of American Muckrakers, said the documents he shared were authentic and in the public interest. Wheeler said his goal was to “expose how desperate the Trump campaign is to try to win" and to provide the public with factual information. He declined to discuss the material's origin.
Without making any specific references, the Trump campaign said earlier this month that Iran's hacking operation was “intended to interfere with the 2024 election and sow chaos throughout our democratic process,” adding any journalists reprinting the stolen documents “are doing the bidding of America’s enemies.”
In 2016, Trump took a different position when he encouraged Russia to hack into Hillary Clinton’s emails and provide them to the press.
LEAK OPERATION
The leak operation started around July when an anonymous email account, [email protected], began communicating with reporters at several media outlets, using the Robert moniker, according to two people familiar with the matter. They initially contacted Politico, the Washington Post and the New York Times, promising damning internal information about the Trump campaign.
In early September, the accused Iranian hackers used a second email address, [email protected], in a fresh round of overtures, including to Reuters and at least two other news outlets, the two people familiar with the matter, said.
At the time, they offered research compiled with public information by the Trump campaign into Republican politicians JD Vance, Marco Rubio and Doug Burgum, all of whom were under consideration as Trump’s running mate.
The vice presidential reports were authentic, a person familiar with the Trump campaign told Reuters. Neither Politico, the Washington Post, the New York Times, nor Reuters published stories based on the reports.
New York Times spokesperson Danielle Rhoades Ha, said the newspaper only published articles based on hacked material “if we find newsworthy information in the materials and can verify them.”
In an email, the Washington Post referred Reuters to past comments made by its executive editor, Matt Murray, who said the episode reflected the fact that news organizations "aren’t going to snap at any hack" provided to them. A spokesperson for Politico said the origin of the documents was more newsworthy than the leaked material. Reuters did not publish this material because the news agency did not believe it was newsworthy, a spokesperson said.
Both AOL email accounts identified by Reuters were taken offline in September by its owner Yahoo, which worked with the FBI before the indictment to trace them to the Iranian hacker group, according to two people familiar with the investigation. Yahoo did not respond to a request for comment.
Before losing email access, Robert suggested reporters might need an alternate contact and offered a telephone number on the encrypted chat application Signal. Signal, which is more difficult to monitor by law enforcement, did not return messages seeking comment.
Some senior U.S. intelligence and law enforcement officials have said that Iran's interference efforts this election cycle are focused on denigrating Trump as they hold him responsible for the 2020 American drone assassination of former Iranian military general Qassem Soleimani.
Thus far, the already-published leaks do not appear to have changed the public dynamics of the Trump campaign.
MUCKRAKERS
On Sept. 26, North Carolina-based American Muckrakers, began publishing internal Trump campaign emails. Active since 2021, the PAC has a history of publicizing unflattering material about high-profile Republicans. According to public disclosure reports, it is funded through individual, small-dollar donors from around the country.
On its website, American Muckrakers said the leaks came from “a source,” but, ahead of the publication last month, the group publicly asked Robert to get in touch. “HACKER ROBERT, WHY THE F DO YOU KEEP SENDING THE TRUMP INFORMATION TO CORPORATE MEDIA?” the group said in a post to X. “Send it to us and we'll get it out.”
When asked whether his source was the alleged Iranian persona Robert, Wheeler said “that is confidential” and that he had “no confirmation of the source's location.” He also declined to comment on whether the FBI had warned him that the communication was the product of a foreign influence operation.
In one example, Muckrakers published material on Oct. 4th purporting to show an unspecified financial arrangement with lawyers representing former Presidential candidate Robert F. Kennedy Jr. and Trump. RFK Jr. attorney Scott Street, said in an email to Reuters he could not speak publicly about the incident. Reuters confirmed the authenticity of the material.
Muckrakers subsequently published documents from Robert about two high-profile races. It included alleged campaign communication about North Carolina Republican gubernatorial candidate Mark Robinson and Florida Republican representative Anna Paulina Luna, both of whom were endorsed by Trump.
The exchange about Robinson concerned an attempt by Republican adviser W. Kirk Bell, to seek guidance from the Trump camp after the scandal over comments attributed to Robinson on a pornographic forum. Robinson has previously denied the comments. The other message came from a Republican adviser sharing information with the campaign about Luna's personal life.
Robinson and Luna’s campaigns did not return messages seeking comment.
One of the few journalists contacted by Robert who did publish material was independent national security reporter Ken Klippenstein, who posted the vice presidential research documents to Substack late last month. Robert confirmed to Reuters that they gave the material to Klippenstein.
Substack did not respond to a question about its policies concerning hacked material.
After the story, Klippenstein said FBI agents contacted him over his communication with Robert, warning that they were part of a “foreign malign influence operation.” In a post, Klippenstein said the material was newsworthy and he chose to publish it because he believed the news media should not be a "gatekeeper of what the public should know."
A spokesperson for Reuters, which received similar notifications from the FBI, said, "We cannot comment on our interactions, if any, with law enforcement." An FBI spokesperson declined to comment on its media notification effort.
Wheeler said he had new leaks in store “soon” and that he would continue to publish similar documents as long as they were “authentic and relevant.”
After two decades of alienating the majority of Iranians—leading over 61% of eligible voters to abstain from the June 2024 presidential election—some within the system now appear to be considering a revival of pre-2005 traditional conservatism.
A report from the centrist website Entekhab noted on Wednesday that the current structure of Iran’s conservative camp appears disjointed, especially after their defeat in the July presidential election, which saw the election of non-factional candidate Masoud Pezeshkian with the backing of “reformist” groups.
Since the disputed 2009 election, which secured ultraconservative Mahmoud Ahmadinejad’s second term, conservatives have attempted to present a unified front ahead of every parliamentary and presidential election. However, these attempts repeatedly fractured, and if not for interventions from Supreme Leader Ali Khamenei and the Guardian Council, the reformist camp might have reclaimed power.
This infighting has steadily diminished the conservative camp, particularly over the past 11 years since pragmatist Hassan Rouhani’s presidency. What remains is a core group of 100 to 160 ultraconservative politicians, primarily linked to the Paydari Party, who advocate for a non-democratic Islamic government rather than the Islamic Republic's semi-democratic structure.
Their ranks have now dwindled to fewer than 80 parliament members and a handful of others in appointed roles, such as those in the Expediency Council.
According to Entekhab, “moderate” conservatives now hold the upper hand in Iranian politics, with Majles Speaker Mohammad Bagher Ghalibaf leading efforts to restore the conservative camp to its pre-2005 stance. The report noted that Ghalibaf has actively worked to limit the influence of Paydari members within the Majles.
This narrative, however, is questionable. To secure his role as Speaker, Ghalibaf maneuvered between Paydari members, other conservatives, and a few pro-reform MPs, ultimately winning the position with votes from the latter. By spring 2024, Paydari had dwindled to just over 60 members, marking one of its lowest points in popularity and membership.
President Pezeshkian disclosed on the day of the Majles vote for his cabinet in August that it was, in fact, Supreme Leader Ali Khamenei—not Ghalibaf—who ensured that all ministers received the necessary vote of confidence from parliament.
Over the past 20 years, especially during Ahmadinejad's presidency, hardliners succeeded in sidelining many moderate conservatives, including former Majles Speaker Ali Akbar Nateq Nouri. In recent years, they have also marginalized other influential conservatives, such as the Larijani brothers—former Chief Justice Sadeq Amoli Larijani and former Majles Speaker Ali Larijani—as well as former President Hassan Rouhani and nearly all of his "pragmatist" allies.
Now, as the country's economy is in its weakest point, the public, as well as politicians in Iran are beginning to remember what Ahmadinejad and the Raisi administration have done to a better economy that existed in Iran until 2005.
Ahmadinejad’s presidency brought sanctions, international isolation, and squandered a massive windfall from soaring oil prices, leaving the treasury depleted by 2013. According to President Pezeshkian’s reserved remarks, the Raisi administration also left virtually nothing for the new government. On his first day in office, Pezeshkian had to borrow from the Khamenei-controlled foreign currency reserve to settle government debts to farmers.
While the shift toward a more moderate conservatism is being spearheaded by Parliament Speaker Ghalibaf, Pezeshkian has shown signs of aligning with hardliners to secure his position.
Over the past week, banners and messages have appeared on highways and over bridges across Tehran urging people to donate to war-affected Lebanese. Iran's Islamic Revolutionary Guard Corps established Hezbollah in 1982 and has heavily armed and funded the group in the decades after.
The fundraising campaign comes as Iran’s own economy is under pressure, with inflation and the rising cost of living taking a toll on livelihoods.
While the level of Iranian assistance to Hezbollah has fluctuated over the years, US officials estimated in 2018 that Iran transfers around $700 million annually to Hezbollah.
A banner in Tehran asked citizens to send an SMS to express readiness to donate to Lebanese while similar campaigns on state TV and through text messages from the paramilitary Basij group encourage people to donate cash, gold, or even to financially sponsor a Lebanese family.
The efforts have drawn criticism from ordinary Iranians, who feel that the government is prioritizing foreign interests over domestic needs.
“It was revealed that the Islamic Republic was sending funds of 50 million dollars per month to support this group," Ali Shirazi, an Iranian journalist, told Iran International TV.
"But this is not the only expense. Military, weaponry, drones, and missile assistance are also provided, and the reconstruction of damaged buildings falls on Iran’s budget,” he added.
Iran's financial and military support for Hezbollah has come under more scrutiny following Israeli strikes on Hezbollah-linked financial institutions, including the Al-Qard al-Hasan bank in Beirut which may have disrupted Hezbollah's access to funds.
"Bunch of freeloaders"
Discontent with the donations campaign is evident among Iranians, many of whom expressed their frustration to Iran International via messaging apps which protect their anonymity.
“The rise in currency exchange rates, the dollar, and the increasing prices of gold have had a very negative impact, destroying the weaker and lower-income classes,” a Tehran resident said.
“People are now finding their food in garbage bins. More than two million students couldn’t attend school this year,” he added.
Others called for redirecting funds towards addressing domestic issues rather than supporting foreign militant groups.
“If we want to help, we prefer to support our fellow compatriots, especially those in need in provinces like Sistan and Baluchestan, rather than sending money to Hamas and Hezbollah,” said a businessman from the northern city of Rasht.
The government’s push for donations was described as out of touch with the reality faced by most Iranians. “For 45 years, we haven’t heard any good news from the media. If the money spent on Lebanon, Syria, and Palestine were spent in Iran, everything would flourish,” commented another citizen.
As inflation continues to rise, with the US dollar trading at 690,000 rials and predictions of further price increases by the end of the year, Iranians are strained.
“I don’t know how long we have to pay the price for Hassan Nasrallah, Ismail Haniyeh and a bunch of freeloaders," a retired citizen said referring to slain Hezbollah and Hamas leaders, "but the impact it’s had has paralyzed everyone’s lives".
