Microsoft flags Iranian cyber ops as threat to US 2024 election

A Microsoft analysis warns Iranian threats have been lurking online and within tech infrastructure, targeting Israel and its allies more frequently since the beginning of the Israel-Hamas war. Microsoft’s Threat Analysis Center flagged those threats as Iranian cyber attacks and influence operations, concluding that Iran’s cyber capabilities pose a threat to the 2024 U.S. presidential election.

As first reported by the Register, Microsoft said Iran’s anti-Israel cyber operations may give the U.S. a peek into how it may use cyber operations to influence the 2024 presidential election.

The Microsoft report, released on Wednesday, Feb. 7, alleged that Iran may have its sights set on the upcoming election based on increased cyber operation activity against Israel that Microsoft documented, along with Iran’s past cyber influence campaigns against the U.S.

According to the report, since the beginning of the Israel-Hamas war, there has been a noticeable increase in traffic to Iranian state-affiliated news sites. Traffic to those sites was up 42% in the first week of the war and was still 28% above pre-war levels.

The number of cyber-enabled influence operations and the number of Iranian groups that Microsoft tracks also jumped in the first few weeks of the war.

Microsoft-tracked groups increased from nine to 14 in the first two weeks of the war.

The latest biannual report on Iran from the Microsoft Threat Analysis Center (MTAC) presents details on the series of cyberattacks and influence operations launched by Iranian government-aligned actors since October 2023: https://t.co/jrrVFqoPbZ

— Microsoft Threat Intelligence (@MsftSecIntel) February 7, 2024

On top of that, Microsoft contends that as the war has progressed, Iranian actors have expanded their scope, attacking countries supporting Israel, like Albania, Bahrain, and the U.S.

“By Nov. 22, IRGC-affiliated groups began targeting Israeli-made programmable logic controllers (PLCs) in the United States, including taking one offline at a water authority in Pennsylvania on Nov. 25,” the report read. “PLCs are industrial computers adapted for the control of manufacturing processes, such as assembly lines, machines, and robotic devices.”

All of this, Microsoft alleges, points to Iran building on the cyber operations it launched to subvert the 2020 U.S. presidential election.

“The Department of Justice is announcing the grand jury indictments of two Iranian nationals for their alleged participation in a multifaceted campaign aimed at influencing and interfering with the United States 2020 presidential election,” said FBI Cyber Division Assistant Director Bryan Vorndran after arrests were made related to the Iranian 2020 operation.

Microsoft warns of the possibility of multiple cyber operations targeting the election from not only Iran, but Russia and China as well.

“The increased collaboration we have observed between different Iranian threat actors will pose greater threats in 2024 for election defenders who can no longer take solace in only tracking a few groups,” the report reads. “Rather, a growing number of access agents, influence groups, and cyber actors makes for a more complex and intertwined threat environment.”