Foreign election interference rarely looks like ballot-stuffing; it looks like targeted persuasion and manufactured distrust. Iran’s Islamic Revolutionary Guard Corps (IRGC) has moved squarely into that lane with overt appeals to U.S. voters and parallel cyber-enabled influence activity calibrated to undercut President Trump and his allies. Understanding the mechanism—not just the headlines—is the only way to blunt it.
The Short Version
- The IRGC issued a lengthy open letter in English urging Americans to reject Trump-aligned candidates in the midterms—a direct, public-facing attempt to shape U.S. voter sentiment.
- U.S. intelligence and law enforcement record a broader Iranian playbook: hack-and-leak operations, intimidation, and messaging designed to exacerbate divisions and erode trust, not to change votes mechanically.
- Tehran publicly denies election interference; those denials do not refute documented operations and indictments tied to IRGC-linked actors.
- The right counter is resilience: narrow the attack surface for hack-and-leak, increase media and voter skepticism toward hostile-state narratives, and preserve confidence in how votes are cast and counted.
What Iran actually did: overt messaging plus covert tradecraft
In the run-up to the midterms, the IRGC published a 25–26 page “open letter” directed at Americans—students, academics, media, and voters—urging them to oppose President Trump’s policies and to “take back control” at the ballot box. The timing—about five weeks before Election Day—was not subtle; IRGC spokesman Hossein Mohebbi even acknowledged the goal was that “voters might hear the message”. This was influence, not espionage: public, branded, and pitched in English with the cadence of a campaign tract.
That overt appeal sits alongside a documented covert wing. Declassified assessments and federal cases describe IRGC-linked operators conducting hack-and-leak and intimidation campaigns in prior cycles: spearphishing, social engineering, theft of nonpublic materials, and orchestrated releases to stoke outrage or demoralization. The Intelligence Community judged with high confidence that Iran ran a 2020 influence campaign to undercut Trump and inflame divisions—even as it found no evidence of any foreign actor altering the technical voting process. DOJ has unsealed indictments against IRGC-affiliated cyber actors for operations designed to influence U.S. voters, including targeted hack-and-leak activity.
Mechanism: how modern foreign influence campaigns move minds
Successful foreign influence does three things well. First, it rides existing grievances rather than inventing them—selecting themes with domestic traction. The IRGC letter framed U.S. policy toward Iran and Israel as a pocketbook-and-values choice for Americans; that is classic issue-piggybacking. Second, it blends channels. Overt statements provide deniability (“we just expressed an opinion”), while covert cyber operations inject stolen or fabricated material into a febrile media environment where speed outruns verification. Third, it aims at confidence, not just candidates. If the electorate believes the system is rigged or chaotic, turnout decisions and post-election legitimacy both bend. The U.S. government’s 2020 and subsequent assessments repeatedly separate “influence” from “interference in the machinery”; the former is the point, the latter is rare and has not been substantiated in recent cycles.
This is also why hack-and-leak remains attractive. It is cheap, asymmetric, and scalable. Phish a staffer, exfiltrate inboxes, drip-release out-of-context snippets, and then sit back as domestic actors—campaigns, partisans, media—amplify for free. The Brennan Center recaps a 2024 episode in which Iranian cyber actors funneled stolen, nonpublic materials associated with Trump’s reelection effort to U.S. media and figures connected to the opposing campaign, a textbook case of laundering foreign access through domestic narratives.
Denials from Tehran—and why they do not resolve the record
Iranian officials have repeatedly rejected claims of election meddling as “hackneyed,” “groundless,” or politically motivated. Iran’s Permanent Mission to the United Nations asserted Tehran has “neither the intention nor the motive” to interfere and demanded public evidence. Such statements are common in statecraft; they are not, by themselves, exculpatory. They do not erase U.S. indictments that attribute cyber operations to IRGC-linked actors, nor do they counter the IRGC’s own public letter addressed to American voters and timed to U.S. elections. The weight of evidence favors a clear conclusion: Iran, through the IRGC and affiliated operators, has conducted a blend of overt persuasion and covert influence aimed at U.S. voters and at the perceived interests of President Trump and his coalition.
Why the IRGC targets the electorate rather than the ballot box
The IRGC is a political-military enterprise with its own media organs, business holdings, and expeditionary networks. It understands that the U.S. election system is decentralized and hardened; altering totals is a high-risk, low-yield fantasy. Shaping the ambient narrative, however—on Israel, sanctions, military posture, or presidential character—can marginally shift turnout, volunteer energy, small-dollar donations, and the post-election climate in which policy is made. That is rational adversary calculus. U.S. agencies have consistently found no evidence of vote-tally manipulation while documenting persistent foreign influence activity aimed at social fissures and confidence in institutions; Iran follows that playbook because it works on the margins that matter in close contests.
The content focus also aligns with Tehran’s objectives. Undercutting a president who has pursued maximum pressure, partnered closely with Israel, and green-lit kinetic action against Iranian assets is congruent with Iranian strategic aims. Messaging that paints those policies as costly, chaotic, or reckless is designed to resonate with constituencies already anxious about conflict and energy prices. Influence thrives where it can reframe, not invent, a voter’s preexisting unease.
How to harden the target without chilling speech
Resilience does not require censorship; it requires friction and context. On the cyber side, campaigns and parties should treat spearphishing as an inevitability and compartmentalize communications accordingly—least-privilege access, hardware security keys, and immutable logging reduce the blast radius when (not if) a credential pops. The DOJ–DHS joint posture around the 2020 cycle—broad information sharing and rapid, public confidence statements about the integrity of voting systems—offers a template worth institutionalizing in every cycle.
On the information side, the discipline is editorial and civic. Newsrooms can slow-roll publication of “leaked” caches until they verify provenance and context. Campaigns can refuse to launder adversary material through oppo dumps. Platforms can label state media and coordinated inauthentic behavior without adjudicating truth. And voters—especially the hyper-engaged—can adopt a simple rule: if a sensational “revelation” appears with murky sourcing in the last 60 days, treat it as suspect until corroborated. CISA’s guidance to stakeholders underscores that a variety of tactics—including front websites posing as legitimate outlets and impersonation operations—will recur; plan for them, don’t react to them.
Iran’s IRGC, a U.S. designated terrorist organization, just wrote Americans a 26-page letter weeks before the midterms to dump your leaders, dump Israel, force Washington out of the Middle East.
That is not a peace offering.
That is an influence operation aimed at the part of…
— Angelia Frankum (@FrankumAngelia) September 30, 2026
The bottom line: measure twice, react once
Iran’s IRGC has attempted to influence U.S. elections via open appeals to voters and via deniable cyber-enabled operations. The record is specific where it needs to be—public letters, dated statements, and indictments—and consistent with a broader pattern the U.S. has mapped since 2016: foreign rivals aim to shape our arguments, not our tabulators. The right response is not panic; it is muscle memory. Secure the data. Verify the documents. Preserve confidence in the counting. And remember that the most powerful countermeasure to a foreign narrative is a domestic audience unwilling to be used.
Sources:
humanevents.com, justice.gov, thehill.com, iranintl.com, dailymail.com, dailywire.com, nournews.ir, vovworld.vn
