The U.S. government has concluded that Iran is behind a series of threatening emails arriving this week in the inboxes of Democratic voters, according to two U.S. officials.
Department of Homeland Security officials told state and local election administrators on a call Wednesday that a foreign government was responsible for the online barrage, according to the U.S. officials and state and local authorities who participated in the call, all speaking on the condition of anonymity because of the matter's sensitivity. A DHS officials also said they had detected holes in state and local election websites and instructed those participating to patch their online services.
The emails claimed to be from the Proud Boys, a far-right group supportive of President Trump, but appeared instead to be a deceptive campaign making use of a vulnerability in the organization's online network.
First identified on Tuesday by local law enforcement and elections officials in Florida and Alaska, the emails were soon turned over to federal authorities, according to U.S. officials.
The messages appeared to target Democrats using data from digital databases known as "voter files," some of which are commercially available. They told recipients the Proud Boys were "in possession of all your information" and instructed voters to change their party registration and cast their ballots for Trump.
By suggesting the group had gained access to privileged data, and also possibly penetrated electronic systems to detect how people were voting, the emails seemed designed to create the appearance of an election breach, said cybersecurity researchers. Such a move may serve to undermine confidence in the integrity of the democratic process without posing a genuine risk to the election, these researchers said.
"You will vote for Trump on Election Day or we will come after you," warned the emails, which by Tuesday night were said to have reached voters in as many as four states, three of them hotly contested swing states in the coming presidential election.
The domain enlisted for the misleading operation, officialproudboys.com, was recently dropped by a hosting company that uses Google Cloud services, according to Google Cloud spokesman Ted Ladd. Without a secure host, the domain stood vulnerable to exploitation, cybersecurity experts said. Voters using Comcast, Yahoo and Gmail accounts were affected.
