Iran’s ‘Robert’ Hack Targets Trump

National security and intelligence analysts warn Iranian hackers may have stolen a trove of private emails from President Donald Trump’s inner circle to show the Iranian public that Tehran can strike back at the United States in cyberspace after attacks on Iranian nuclear sites.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The warnings follow threats from a group of Iran-linked hackers calling themselves “Robert,” who claim they stole 100 gigabytes of emails tied to White House Chief of Staff Susie Wiles, Trump lawyer Lindsey Halligan, adviser Roger Stone and Stormy Daniels, the adult film star at the center of the president’s 2016 sex scandal. The hacking group – which the Department of Justice linked to Iran’s Revolutionary Guards in September 2024 – told Reuters it might sell the emails, but offered no details on content or plans.

Experts told Information Security Media Group that “Robert” may indeed have authentic emails from Trump’s inner circle, pointing out the group previously leaked Trump campaign messages and Daniels settlement emails during the 2024 election that were later verified by multiple outlets. Max Lesser, senior analyst at the Foundation for Defense of Democracies, said this latest effort likely aims to show Iran’s cyber reach to deter future attacks and shape its own domestic political discourse.

“Perhaps Tehran calculated that a personal hack-and-leak against President Trump and his inner circle might hit most where it hurts,” Lesser said. Iran “has historically compromised soft targets in President Trump’s inner circle that presumably don’t have the same cybersecurity protections afforded to U.S. government employees”.

He added that the U.S. government may want to consider identifying proactively reach out “to offer increased cybersecurity protections.”

The hacking group’s threats come after weeks of warnings that Iran was preparing cyberattacks against Israel, the U.S. and its allies (see: Israel-Iran Ceasefire Holding Despite Fears of Cyberattacks).

The Cybersecurity and Infrastructure Security Agency, along with the FBI and other federal partners, recommended critical infrastructure operators on Monday to “remain vigilant” against possible cyber strikes by Iranian state-backed or affiliated hackers. The advisory noted “increasing activity from hacktivists and Iranian government-affiliated actors” exploiting vulnerable targets.

It remains unclear how the hacking group allegedly stole such a large trove of data or whether the emails are more damaging than the batch released during the 2024 campaign, which had little effect on the election. A former Department of Defense cybersecurity official, who requested anonymity to discuss Iran-linked operations, said the cache might simply be old emails held back to “effectively maximize impact.”

Robert’s 2024 hack-and-leak effort against Trump “wasn’t all that successful, so there’s a chance they kept these [emails] in their back pocket for future use,” the former official told ISMG. “But even just the threat of leaking blackmail against the American president does more to influence people inside Iran than it does anything in the U.S. – especially outside an election cycle.”

CISA Director of Public Affairs Marci McCarthy described Robert’s claims in a post on X as “nothing more than digital propaganda” and “a calculated smear campaign meant to damage President Trump.” The White House also responded to the developments with a state from FBI Director Kash Patel, who said any threat actors “associated with any kind of breach of national security will be fully investigated and prosecuted to the fullest extent of the law.”