Iran-linked hackers threaten to release emails of Trump associates

(Patria) - Iran-linked hackers have threatened to release more emails stolen from the circle of US President Donald Trump, after distributing a previous batch to the media ahead of the 2024 US elections, Reuters reported.

In online conversations with Reuters on Sunday and Monday, the hackers, using the pseudonym Robert, said they have approximately 100 gigabytes of emails from the accounts of White House Chief of Staff Susie Wiles, Trump attorney Lindsey Halligan, Trump advisor Roger Stone, and porn star turned Trump antagonist Stormy Daniels.

Robert mentioned the possibility of selling the material but otherwise provided no details about his
plans. The hackers did not describe the contents of the emails.

Halligan, Stone, a representative for Daniels, and the US Cybersecurity and Infrastructure Security Agency (CISA) did not immediately respond to requests for comment. The White House and FBI responded with a statement from FBI Director Kash Patel, who said: “Anyone connected to any type of national security violation will be thoroughly investigated and prosecuted to the fullest extent of the law.” Iran’s mission to the United Nations did not immediately respond to a Reuters message seeking comment. Tehran has denied engaging in cyber espionage in the past.

Robert emerged in the final months of the 2024 presidential campaign, when they claimed to have broken into the email accounts of several Trump allies, including Wiles. The hackers then distributed emails to journalists. Reuters previously confirmed the authenticity of some of that material, including an email that appeared to document a financial arrangement between Trump and lawyers representing former presidential candidate Robert F. Kennedy Jr. — now Trump’s health secretary.

Other material included Trump campaign discussions about Republican candidates for office and a discussion about settlement negotiations with Daniels. Although the leaked documents received some media coverage last year, they did not fundamentally alter the presidential race, which Trump won.

The US Justice Department alleged in a September 2024 indictment that Iran’s
Revolutionary Guard Corps ran the hacking operation Robert. In conversations with Reuters, the hackers declined to respond to this assertion.

After Trump’s election, Robert told Reuters that no further leaks were planned. As recently as May, the hackers told Reuters: “I’m retired, man.” But the group
resumed communication after a twelve-day air war between Israel and Iran this month, which culminated in US airstrikes on Iranian nuclear sites.

In messages this week, Robert said they were organizing the sale of the stolen emails and wanted Reuters to “broadcast this thing.”

Frederick Kagan, a scholar at the American Enterprise Institute who has written about Iranian cyber espionage, said Tehran had suffered serious damage in the conflict and its spies were likely trying to retaliate in ways that would not provoke further action by the United States or Israel.

“The implied explanation is that everyone has been ordered to use whatever asymmetric things they can that are unlikely to provoke a continuation of major Israeli-US military activities,” he said.

“Leaking a lot more emails is unlikely to do that.”

Despite concerns that Tehran might unleash digital chaos, Iranian hackers have largely stayed on the sidelines during the conflict. US cybersecurity officials warned on Monday that US companies and critical infrastructure operators could still be targets for Tehran.