Iran-Linked Hackers Threaten to Release More Stolen Trump Aides’ Emails

An Iran-linked hacking group, operating under the pseudonym “Robert,” has issued a fresh threat to release a substantial cache of emails purportedly stolen from individuals in President Donald Trump’s inner circle. This development comes after the group previously distributed some hacked communications to media outlets in the lead-up to the 2024 U.S. presidential election.

According to online chats with Reuters, the hackers claim to possess approximately 100 gigabytes of emails from accounts belonging to prominent figures such as White House Chief of Staff Susie Wiles, Trump attorney Lindsey Halligan, adviser Roger Stone, and even adult film actress Stormy Daniels. While the hackers hinted at the possibility of selling the material, they did not provide specific details about the content of the emails or their release timeline.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) swiftly responded to the threat, labeling it as “digital propaganda” and a “calculated smear campaign meant to damage President Trump and discredit honorable public servants.” CISA emphasized that such actions by a “hostile foreign adversary” aim to “distract, discredit, and divide.” FBI Director Kash Patel affirmed that “anyone associated with any kind of breach of national security will be fully investigated and prosecuted to the fullest extent of the law.”

The “Robert” group first emerged in the final months of the 2024 presidential campaign, claiming to have breached the email accounts of several Trump allies and distributing some of the material to journalists. While some of the previously leaked documents were authenticated by Reuters, they did not significantly impact the outcome of the presidential race, which Trump won. The U.S. Justice Department, in a September 2024 indictment, alleged that Iran’s transformative Guards ran the “Robert” hacking operation, an accusation the hackers have not addressed.

Interestingly, after Trump’s election, the group had reportedly indicated no further leaks were planned, with messages as recent as May suggesting they were “retired.” However, communication resumed following a recent 12-day air conflict between Israel and Iran, which included U.S. bombing of Iranian nuclear sites. Experts, such as Frederick Kagan of the American Enterprise Institute, suggest this renewed activity could be a form of “asymmetric” retaliation from Tehran, aiming to cause disruption without triggering further military action.

U.S. cyber officials have issued warnings that American companies and critical infrastructure operators remain potential targets for Iran-linked cyber threats, urging vigilance and enhanced cybersecurity measures. As the situation unfolds, the focus remains on assessing the authenticity and potential impact of the threatened data release, alongside efforts to bolster national cybersecurity defenses against state-sponsored digital incursions.