Krebs: Iranian outreach to Biden campaign was 'late breaking' news to U.S. gov

The former CISA director said Iran's operation was "not something" the government had "been tracking for months."

SCOTTSDALE, Ariz. — U.S. authorities have only recently become aware that the Iranians working as part of a hack-and-leak operation targeting President Donald Trump’s campaign attempted to share excerpts of stolen material with people associated with President Joe Biden’s campaign, a former top U.S. cybersecurity official said Thursday. 

Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency, told reporters at the SentinelOne LABScon conference that based on conversations with people either in the federal government or those who have recently departed, “this is fairly late breaking” and something “the government’s only been aware of for the last couple of weeks, not something they’ve been tracking for months.”

Krebs, now the chief intelligence and public policy officer at SentinelOne, made the comment the day after the U.S. government said it had learned the Iranians “sent unsolicited emails to individuals then associated with President Biden’s campaign that contained an excerpt taken from stolen, non-public material from former President Trump’s campaign as text in the emails.”

There is no indication that the targets of those emails replied, according to a joint statement from the Office of the Director of National Intelligence, the FBI and CISA. “Furthermore, Iranian malicious cyber actors have continued their efforts since June to send stolen, non-public material associated with former President Trump’s campaign to U.S. media organizations.”

The statement noted that the FBI learned of the attempts after an Aug. 19 joint statement confirming public reporting that an Iranian-linked operation had targeted people close to both campaigns. The operation successfully compromised people close to the Trump campaign and obtained internal campaign materials, Microsoft reported Aug. 9, followed by confirmation from the Trump campaign Aug. 10.

The FBI did not immediately respond to a request for comment Thursday about the timeline or how it learned of the targeting connected to the Iranian operation. A spokesperson for Vice President Kamala Harris’ campaign did not immediately respond to questions about whether the people targeted as part of the Biden campaign are now working with the Harris campaign, or if those people notified authorities of the activity.

The Iranian government has denied the U.S. allegations.

“Already devoid of any credibility and legitimacy, such allegations are fundamentally unfounded, and wholly inadmissible,” a Permanent Mission of the Islamic Republic of Iran to the United Nations spokesperson told CyberScoop late Wednesday. “The Islamic Republic of Iran does not engage in the internal uproars or electoral controversies of the United States.

“Having already unequivocally and repeatedly announced, Iran neither has any motive nor intent to interfere in the U.S. election; and, it therefore categorically repudiates such accusations,” the spokesperson continued. “Should the U.S. government genuinely seek the truth, it is incumbent upon them to formally and transparently provide their substantiated evidence, so as to receive a corresponding and precise response. The continued perpetuation of such unfounded claims will only serve to undermine their credibility.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems