Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

Summary

This Joint Cybersecurity Advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). CISA and the FBI are aware of an Iranian advanced persistent threat (APT) actor targeting U.S. state websites — to include election websites. CISA and the FBI assess this actor is responsible for the mass dissemination of voter intimidation emails to U.S. citizens and the dissemination of U.S. election-related disinformation in mid-October 2020. (Reference FBI FLASH message ME-000138-TT). Further evaluation by CISA and the FBI has identified the targeting of U.S. state election websites was an intentional effort to influence and interfere with the 2020 U.S. presidential election.

This Joint Cybersecurity Advisory contains technical details, indicators of compromise, mitigation strategies, and is being provided for situation awareness.