Iranian Hacking Group Cotton Sandstorm Targets U.S. Election Infrastructure Ahead of 2024 Presidential Election

As the United States gears up for the 2024 presidential election, concerns about foreign interference are once again at the forefront of national security discussions. A recent report from Microsoft has revealed that an Iranian hacking group known as Cotton Sandstorm is actively targeting election-related websites and media outlets across the U.S. This group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has been conducting reconnaissance and probing key election systems in several battleground states, raising alarms about potential foreign meddling in the electoral process.

Cotton Sandstorm’s Activities and Objectives

The Microsoft report, released on October 23, highlights Cotton Sandstorm’s activities in various critical states, where the group has been assessing vulnerabilities in election infrastructure. Their efforts are not limited to technical probing; in May 2023, the group scanned an unidentified U.S. media outlet, likely seeking to uncover weaknesses that could be exploited for more direct influence operations. This pattern of behavior underscores a strategic approach to sow discord and manipulate public perception ahead of the election.

A Troubling History of Election Interference

Cotton Sandstorm’s involvement in U.S. elections is not a new phenomenon. During the 2020 presidential election, the group executed a cyber-influence operation aimed at spreading disinformation and creating chaos. Posing as members of the right-wing group “Proud Boys,” the hackers sent threatening emails to Florida voters, pressuring them to support then-President Donald Trump. While this campaign did not directly compromise voting systems, it aimed to instill doubt and confusion regarding the electoral process.

In the aftermath of the 2020 election, Cotton Sandstorm escalated its operations, encouraging violence against election officials who dismissed claims of widespread voter fraud. Such actions highlighted the group’s intent to destabilize the democratic process and undermine public confidence in election outcomes.

Microsoft’s Findings on 2024 Election Threats

Microsoft’s Threat Analysis Center (MTAC) warns that Cotton Sandstorm is expected to intensify its activities as the 2024 election approaches. The report states, “Cotton Sandstorm will increase its activity as the election nears, given the group’s operational tempo and history of election interference.” This uptick in activity is part of a broader campaign by foreign actors, including Russia and China, to influence U.S. politics through divisive content.

U.S. government agencies, including the Office of the Director of National Intelligence (ODNI), have corroborated these findings, confirming that foreign adversaries remain intent on undermining American confidence in the democratic system. “Foreign actors — particularly Russia, Iran, and China — remain intent on fanning divisive narratives to divide Americans and undermine Americans’ confidence in the U.S. democratic system,” ODNI stated in a previous report.

The Rise of Cyber-Influence Operations

The tactics employed by Cotton Sandstorm are indicative of a larger strategy by foreign nations to manipulate public perception through disinformation campaigns. Microsoft notes that Iran’s cyber operations have extended beyond the U.S. presidential election, with the group launching cyber-attacks against various targets, including U.S. media outlets. These attacks have utilized stolen, non-public information from the Trump campaign to fuel their efforts.

Meanwhile, Russian cyber actors have shifted their focus towards Democratic candidate Kamala Harris, employing AI-generated content to disseminate false information. Instances of deepfake videos featuring Harris making derogatory comments about Trump have circulated online, reflecting Russia’s ongoing attempts to interfere in U.S. elections. Similarly, Chinese actors have targeted down-ballot candidates and members of Congress, particularly those with anti-China policies, in an effort to smear their reputations and bolster opposition candidates.

Heightened Concerns Over Foreign Influence

The increasing frequency and sophistication of these foreign influence operations pose a significant threat to the integrity of the upcoming U.S. presidential election. Historically, foreign actors have demonstrated a remarkable ability to rapidly spread deceptive content, with the potential to shape public opinion and influence electoral outcomes.

As Election Day approaches, it is crucial for voters and institutions to remain vigilant against online disinformation. Foreign adversaries, particularly those from Russia, Iran, and China, are expected to escalate their efforts in the final days leading up to November 5, seeking to exploit divisions and create uncertainty around the election results.

Iran’s Response and the Outlook Ahead

In response to Microsoft’s allegations, a spokesperson for Iran’s mission to the United Nations dismissed the claims as “fundamentally unfounded and wholly inadmissible.” The spokesperson asserted that Iran has no intent to interfere in U.S. elections. However, U.S. officials remain cautious, given Cotton Sandstorm’s previous actions and the broader context of foreign interference.

Despite these denials, U.S. government agencies are taking the threat of foreign interference seriously. Coordinated efforts are underway across multiple levels of government to safeguard election integrity, with a heightened focus on monitoring cyber-influence campaigns and ensuring transparency in the electoral process.

The Importance of Vigilance

Microsoft’s MTAC report emphasizes the need for early detection and public awareness in countering these influence campaigns. With less than two weeks until Election Day, the call for heightened vigilance is more critical than ever, particularly during the 48-hour window before and after Election Day when disinformation is likely to peak.

By remaining alert and skeptical of suspicious online content, voters and government institutions can help minimize the impact of foreign interference. Fact-checking and rapid response measures are essential to maintaining public trust in the democratic process. As the final stretch of the 2024 election approaches, the resilience of the U.S. electoral system will once again be tested by foreign adversaries intent on disrupting the outcome.

Microsoft’s ongoing reports and warnings serve as a reminder of the growing threat posed by foreign cyber actors and the need for collective action to defend the integrity of democratic processes. In an era where information is power, safeguarding the truth is paramount to preserving the foundations of democracy.