Germany summons Iranian ambassador over alleged espionage plot

The group, which leaked a prior batch ahead of the 2024 presidential election, said it holds roughly 100 gigabytes of emails from accounts including White House Chief of Staff Susie Wiles, Trump lawyer Lindsey Halligan, adviser Roger Stone, and Stormy Daniels, a notorious Trump critic.

In online chats with Reuters, the hackers hinted at possibly selling the stolen material but gave few details about their intentions or the content of the emails.

US Attorney General Pam Bondi called the breach “an unconscionable cyber-attack,” while FBI Director Kash Patel vowed that anyone involved in national security breaches would face full prosecution.

The Cybersecurity and Infrastructure Security Agency (CISA) labeled the incident “digital propaganda” aimed at damaging Trump and discrediting public servants.

Robert emerged during the final months of the 2024 campaign, distributing emails that Reuters verified included a financial arrangement between Trump and Robert F. Kennedy Jr., now Trump’s health secretary.

Other leaked documents showed internal Trump campaign communications and settlement talks with Daniels. While these leaks received media attention, they did not significantly impact the election outcome.

In a 2024 indictment, the US Justice Department accused Iran’s Revolutionary Guards of orchestrating the Robert hacking operation. The hackers declined to address this allegation in their conversations with Reuters.

Despite earlier remarks to Reuters that no further leaks were planned and that the group had “retired,” Robert re-engaged following the recent 12-day conflict between Israel and Iran, which culminated in US strikes on Iranian nuclear sites.

This week, the hackers told Reuters they were organizing a sale of stolen emails and requested that Reuters publicize the matter.

Frederick Kagan, a scholar on Iranian cyberespionage at the American Enterprise Institute, suggested the renewed hacking reflects Tehran’s efforts to retaliate asymmetrically without provoking a larger military response.

"A default explanation is that everyone's been ordered to use all the asymmetric stuff that they can that's not likely to trigger a resumption of major Israeli/US military activity," he said. "Leaking a bunch more emails is not likely to do that."

While concerns remain about Iran’s cyber capabilities, the hackers maintained a low profile during the conflict. US cyber officials warned that American companies and critical infrastructure could still be targeted in the future.

During the 12-day war with Israel, several Iranian banks and cryptocurrency platforms were hacked in coordinated cyberattacks. Iranian authorities, fearing further breaches of critical infrastructure, responded by shutting down internet access nationwide.

While the government cited cybersecurity as the rationale, the primary aim was to limit public access to wartime information and suppress its dissemination on social media.

“We kindly request the esteemed Embassy of Ireland to facilitate and support the establishment of international roaming agreements with active operators in Ireland,” the Mobile Company of Iran (MCI) wrote in a January 6 letter seen by the newspaper through a Freedom of Information Act request..

MCI, one of Iran's largest mobile operators, is majority-owned by a company believed to be controlled by the IRGC. The firm told the Irish embassy it already had roaming deals in place with 200 operators in 110 countries and wanted to expand its coverage to Ireland, citing “the friendly relations” between the two states.

The IRGC, designated as a terrorist organization by the United States, plays a key role in Iran’s economy and foreign policy, including its backing of groups like Hezbollah and Hamas.

According to the report, Ireland's ambassador to Tehran, Laoise Moore, did not respond to the request.

Vodafone, which had a prior agreement with MCI, cut ties last year citing concerns about sanctions compliance. A spokesperson for Eir said its roaming deals were vetted against publicly available sanctions lists, but the company declined to comment on MCI specifically.

Ireland’s Department of Foreign Affairs confirmed that while the IRGC is under sanctions, MCI is not. Three Ireland did not comment on whether it had held any discussions with the Iranian company, according to the report.

“I don’t think negotiations will restart as quickly as that,” Foreign Minister Abbas Araghchi said in his first interview with an American news outlet since the June airstrikes, when asked about President Donald Trump’s suggestion that talks could resume as soon as this week. “We will have to first ensure that America will not revert to targeting us in a military attack during the negotiations.”

However, he added, “The doors of diplomacy will never slam shut.”

Iran not backing down from enrichment, Araghchi says

Asked whether Iran would continue uranium enrichment, Araghchi said, “Our peaceful nuclear program has turned into a matter of national pride and glory. We have also gone through 12 days of imposed war; therefore, people will not easily back down from enrichment.”

US June strikes targeted Iran’s nuclear facilities at Fordow, Natanz, and Isfahan. While US officials said the sites were “completely and totally obliterated,” Rafael Grossi, head of the International Atomic Energy Agency (IAEA), offered a more measured assessment. He told CBS News the facilities had sustained “significant destruction,” but Iran retained enough capacity to resume enrichment within months.

"One cannot obliterate the technology and science for enrichment through bombings," Araghchi said. "If there is this will on our part, and the will exists in order to once again make progress in this industry, we will be able to expeditiously repair the damages and make up for the lost time."

US warns against renewed enrichment

US President Donald Trump has said further enrichment activity could trigger additional strikes. Asked about the possibility, Araghchi said Iran was prepared for more attacks. “We showed and proved during this 12-day imposed war that we have the ability to defend ourselves, and we will continue to do so should any aggression be launched against us.”

Still, the White House said no new talks are officially scheduled. According to CBS, Araghchi did not offer a timeline for when diplomacy might resume. He said Iran still needed to evaluate the security situation and was not ready to return to negotiations “as quickly as that.”

“We must quickly show that we have the ability to reconstruct in all postwar sectors,” Aref said during a meeting with managers from the National Development Group Investment Company. He called postwar reconstruction and renewal the country’s top national priority.

Aref said the government had prepared a war economy plan early in its term, anticipating reduced oil revenues. He said the economic front had held strong during the conflict, adding, “There was not a single flaw in the performance of our economic front during the 12-day war.”

Aref warned against trusting Israel or the United States in the aftermath of the ceasefire. “There is no guarantee of their promises,” he said.

The article said that while the UK Treasury is investigating nine suspected violations of sanctions in 2024, “these sanctions violations are of course concerning, but only constitute a small part of Iran’s clandestine political influence and illicit finance operations in Britain.” The campaign, it said, reflects a longer-standing effort by Tehran to undermine the United Kingdom in response to decades of hostility between the two governments.

Historical context and anti-UK messaging

Tensions between the two countries go back decades, and The Telegraph noted that Iran has consistently framed the United Kingdom as a hostile power.

According to the report, this messaging forms part of a larger strategy aimed at undermining states perceived as adversaries, particularly those aligned with the United States.

Iran-linked media and advocacy in Britain

Press TV, Iran’s state-backed English-language broadcaster, previously held a broadcast license to operate in the UK. The Telegraph said that although the license was revoked in 2012, the channel continues to publish content online that promotes Iranian state positions.

The report also referenced UK-based organizations, including the Islamic Human Rights Commission, which has faced scrutiny for its messaging and continues to organize Quds Day demonstrations in central London. The Telegraph said some of these events included visible support for Hezbollah before the group was designated a terrorist organization in the UK.

Concerns over Iranian banks in London

Iranian financial institutions with past sanctions histories, including Melli Bank and Bank Saderat, still maintain offices in London, The Telegraph said. It noted that these banks operate near the Bank of England and have been raised as a concern by Members of Parliament.

According to the report, both institutions have previously been linked by international authorities to financial activities involving armed groups in the Middle East.

Online disinformation tied to Iran

Iranian influence efforts have also extended to social media, according to The Times. The paper reported that OpenAI identified a network called Storm-2035, which it said was likely linked to Tehran. The network used Persian-language prompts to generate English and Spanish posts on wedge issues, such as austerity, independence movements, and foreign policy.

OpenAI said the content was posted on X by accounts posing as local users. These accounts often used stock images and followed far more users than they had followers.

Scottish independence messaging monitored

The Telegraph also referenced Iranian involvement in online messaging around Scottish independence, citing researchers who linked the activity to broader attempts to exploit domestic divisions in the UK.

According to The Times and Scottish Daily Express, several pro-independence X accounts with apparent Iranian ties went silent after Israeli strikes on Iranian infrastructure on June 12. The Scottish Daily Express cited research from Clemson University suggesting the network may have been tied to the Islamic Revolutionary Guard Corps.

Government response limited, Telegraph says

While UK authorities have taken some action, The Telegraph said responses have so far not matched the scale of the challenge. The paper described Iran’s operations as “enabled by years of dereliction from policymakers” and said more sustained coordination would be needed to counter foreign influence campaigns effectively.