U.S. Charged 2 Iranian Hackers for Threatening Voters During 2020 Presidential Election

The U.S. government on Thursday unsealed^[1]
an indictment that accused two Iranian nationals of their
involvement in cyber-enabled disinformation and threat campaign
orchestrated to interfere in the 2020 presidential elections by
gaining access to confidential voter information from at least one
state election website.

The two defendants in question — Seyyed Mohammad Hosein Musa
Kazemi, 24, and Sajjad Kazemi, 27 — have been charged^[2]
with conspiracy to commit computer fraud and abuse, intimidate
voters, and transmit interstate threats, voter intimidation,
transmission of interstate threats, with Kazemi additionally
charged with unauthorized computer intrusion. Both the individuals
are currently at large^[3].

The influence campaign’s goal was to erode confidence in the
integrity of the U.S. electoral system and to sow discord among
Americans, the Department of Justice (DoJ) said in a statement,
characterizing the two individuals as “experienced Iran-based
computer hackers” who carried out the attacks during their work as
contractors for an Iranian company named Emennet Pasargad
(formerly Eeleyanet Gostar).

As part of the coordinated election interference scheme, Kazemi
and Kazemi are alleged to have attempted to compromise nearly 11
state voter registration and information websites between September
and October 2020, successfully breaching a misconfigured computer
system in an unnamed state to retrieve details associated with more
than 100,000 voters.

The siphoned data was then used to simulate intrusions that the
Democratic Party was supposedly planning to carry out by exploiting
election infrastructure vulnerabilities to register non-existent
voters and edit mail-in ballots, all of which were captured in the
form of a “False Election Video” that was distributed to Republican
Senators, White House advisors, and several members of the
media.

“The access of voter registration data appeared to involve the
abuse of website misconfigurations and a scripted process using the
cURL tool to iterate through voter records,” the U.S. Cybersecurity
and Infrastructure Security Agency (CISA) noted^[4]
back in November 2020. “A review of the records that were copied
and obtained reveals the information was used in the propaganda
video.”

Besides the aforementioned activities, the defendants are said
to have sent threatening email messages to intimidate and interfere
with voters and successfully gained unauthorized access to an
unspecified media company’s computer network using stolen
credentials with the goal of disseminating false claims after the
election on November 4, 2020. The attacks were ultimately foiled,
the DoJ said.

In a related development, the Treasury Department’s Office of
Foreign Assets Control (OFAC) announced sanctions^[5]
against Kazemi and Kashian, and four other Emennet employees, for
carrying out disruptive cyber operations against the U.S. and
providing technological support to the Iranian Islamic
Revolutionary Guard Corps, even as the State Department offered a
reward of up to $10 million for information about the whereabouts
of these two individuals or their activities.

The indictments come a little over a year after CISA and the
Federal Bureau of Investigation (FBI) issued an advisory^[6]
warning of Iranian threat actors’ endeavors to influence and
interfere with the U.S. elections by “creating fictitious media
sites and spoofing legitimate media sites to spread obtained U.S.
voter-registration data, anti-American propaganda, and
misinformation about voter suppression, voter fraud, and ballot
fraud.”

Iranian hacking groups have been in the spotlight in the past
few days, with cybersecurity agencies across the U.S., U.K., and
Australia alerting^[7]
of ongoing malicious infiltrations targeting organizations
worldwide by exploiting Fortinet and Microsoft Exchange ProxyShell
vulnerabilities to exfiltrate sensitive data and increasingly deploy ransomware^[8].