The three hackers, all of whom have ties to Iran's Islamic Revolutionary Guard Corps, are believed to have gained access to campaign staff accounts using social engineering and spear phishing, a tactic that attempts to trick victims into disclosing sensitive information. They then used the hijacked accounts to steal non-public campaign documents and emails, which they released to the press.
As outlined in the indictment, the US linked the hackers to an Iranian internet service provider, Respina Networks, which allegedly gave them “unrestricted” internet access outside of Iran. It's also about how they used a commercial virtual private network (VPN) to create numerous fake domains such as “tinyurl.ink” and “mailer-daemon.online”, which they ultimately used to mislead their victims.
The US accuses the three hackers of wire fraud, providing material support to a terrorist organization and conspiring to obtain information from protected computers. “These hack-and-leak efforts by Iran represent a direct attack on the integrity of our democratic processes,” Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division said in the release. “Iranian government actors have long sought to use cyber-enabled means to harm U.S. interests.”