Iran-linked hackers threaten to release White House email cache

Marci McCarthy, spokesperson for the US Cybersecurity and Infrastructure Security Agency (CISA), said: “A hostile foreign adversary is threatening to illegally exploit purportedly stolen and unverified material in an effort to distract, discredit and divide.

"This so-called cyberattack is nothing more than digital propaganda and the targets are no coincidence.

"This is a calculated smear campaign designed to damage President Trump and discredit honourable public servants who serve our country with distinction.

"These criminals will be found and they will be brought to justice.”

Likewise, FBI Director Kash Patel said: “Anyone associated with any kind of breach of national security will be fully investigated and prosecuted to the fullest extent of the law.”

However, the hacker group, known by the pseudonym Robert, has previously distributed such emails to journalists – notably before the 2024 election.

According to Reuters, some of this material was verified at the time, including some of those referring to the Daniels scandal.

A 2024 Justice Department indictment claimed that the Robert operation was run indirectly by the IRGC from Tehran.

Whether the material is genuine or not, the threat appears to reflect a broader trend of escalating cyber warfare from the Islamic Republic following US strikes on its nuclear sites last week.

Indeed, the regime mounted a comprehensive campaign to undermine American public support for military action by deploying a sophisticated bot network that disseminated hundreds of thousands of deceptive messages, according to groundbreaking research commissioned by Israel’s Ministry of Diaspora Affairs and Combating Antisemitism.

The investigation, which analyzed social media activity on X during "Operation Rising Lion," identified at least 100 fabricated accounts systematically promoting Tehran's strategic messaging.

Beyond merely spreading disinformation to glorify Iranian successes while fabricating Israeli failures, Tehran invested substantial resources in targeting domestic audiences within Israel and the United States.

The accounts maintained continuous activity across all hours without typical human patterns of rest. Moreover, they generated content at superhuman speeds, posting thousands of messages daily.

The content frequently appeared identical or remarkably similar across multiple suspicious accounts, strongly indicating coordinated bot activity. The examined network ultimately distributed 241,712 posts, reaching millions of users worldwide.

Iranian messaging operations were divided into four distinct categories: promoting regime loyalty and Supreme Leader Ali Khamenei, distributing false reports of Israeli military failures, characterising Israel as a terrorist state that "murders children" and "massacres Palestinians" and attempting to weaken domestic support for Trump.

These accounts amplified messaging identical to Republican critics of the military strikes. For instance, following Trump advisor Steve Bannon's claims that Israeli Prime Minister Benjamin Netanyahu exercised control over the president, Iranian accounts circulated imagery depicting Trump as Netanyahu's marionette or as a dog owned by the Israeli leader.

The findings showed Trump was consistently portrayed across the bot network as Netanyahu's puppet.

The network also promoted antisemitic messaging targeting the American Israel Public Affairs Committee (AIPAC) and Jewish Americans as allegedly controlling US decision-making, echoing themes from American isolationist movements. The research notes, however, that Iranian bots did not directly coordinate with actual American opposition voices.