Iran-backed hackers sought to blackmail Bolton over emails - indictment

"Recently, three Iranian state-affiliated actors attacked shipping and logistics firms in Europe and the Persian Gulf to gain ongoing access to sensitive commercial data, raising the possibility that Iran may be pre-positioning to have the ability to interfere with commercial shipping operations," the report said.

In response, Iran’s mission to the United Nations denied the allegation, saying Tehran “is not the initiator of any offensive cyber operations against any country.”

The mission said Iran is a victim of cyberattacks itself and “will respond to any cyber threat in proportion to its nature and scope.”

Microsoft's report comes just days after Britain’s MI5 warned members of Parliament that spies from China, Russia and Iran are targeting UK politicians in an effort to influence policy, gather intelligence and undermine democracy.

On Tuesday, MI5 Director General Ken McCallum urged lawmakers to stay alert to blackmail attempts, phishing attacks, and approaches from individuals seeking to cultivate long-term relationships or make donations to sway decisions.

FBI director Kash Patel on Wednesday said the United States has seen a 50% increase in espionage cases linked to Iran.

US security agencies had warned in July of increased risk from Iranian cyber actors.

“Based on the current geopolitical environment, Iranian-affiliated cyber actors may target US devices and networks for near-term cyber operations,” the Cybersecurity and Infrastructure Security Agency (CISA) said in the report, issued jointly with the National Security Agency (NSA), Department of Homeland Security (DHS), and FBI.

"Iran's autocratic regime is ... frantically trying to silence its opponents around the world, including in the UK," he told reporters in a briefing.

"2025 has required us to grow our counter Iran effort," McCallum added. "MI5 has tracked more than 20 potentially lethal Iran-backed plots in just the one year since I last stood at this podium. The UK was among the first to call out this wave of Iranian transnational aggression. But we're far from alone."

The British government last month said it was determined to frustrate what it called escalating Iranian threats to people on UK soil, citing cyberattacks and the use of criminal proxies to carry out attacks.

Its statement came after a July 10 Parliamentary Intelligence and Security Committee on Iran which said Iran poses one of the gravest state-based threats to British national security, on par those from Russia and China.

"State threats are escalating. In the last year, we've seen a 35% increase in the number of individuals we're investigating for involvement in state threat activity," McCallum added, mentioning Russia and China as other key adversaries.

FBI Director Kash Patel said in a presentation to President Donald Trump and reporters in the White House on Wednesday that US law enforcement had stepped up arrests for Iran-backed espionage operations.

"The national security mission, Mr. President, under your leadership has never been stronger. We have gone after espionage activities against our main counterparts in China, Russia and Iran," he said.

"(On) Iran, we have had a 50% increase again in espionage cases."

“While Iran has not binned or ended discussions with the IAEA on implementing the Cairo access deal, I understand it still hasn’t issued reports or given dates for issuing reports on damaged sites and stockpile. Nor of course permitted access to damaged sites,” Laurence Norman wrote on X. He said IAEA chief Rafael Grossi “is for now being given more space” but continues to press Tehran to advance on these steps.

The comments come as Iran’s Atomic Energy Organization chief Mohammad Eslami said on Wednesday that “no IAEA inspector is currently in the country.” Eslami said only two visits had been allowed since the June airstrikes on Iranian nuclear facilities — to Bushehr and Tehran reactors — both cleared by the Supreme National Security Council.

The Cairo deal, reached in September between Foreign Minister Abbas Araghchi and Grossi, was meant to restore limited cooperation after the strikes. It outlined “practical modalities” for monitoring declared nuclear sites, but Iranian officials warned the accord could collapse if UN sanctions were reinstated. Western governments triggered the snapback of those sanctions in late September, citing Iran’s failure to meet its obligations.

Eslami said Iran is not considering leaving the Nuclear Non-Proliferation Treaty but faulted the IAEA for failing to condemn the US and Israeli attacks. “The agency should have condemned the attack on Iran’s nuclear sites, but it did not,” he said, adding that Iran’s cooperation is now governed by a new parliamentary law limiting access.

Norman said the IAEA has so far avoided demanding immediate access to a specific site to prevent a direct refusal by Tehran, “risking a crisis.” He added that Iran “could play its old game of offering something ahead of [the] November IAEA board” but warned that without progress, “we could be running into another significant moment in November.”

The man told investigators he acted to protest US support for Israel’s war in Gaza.

The 28-year-old Norwegian, whose name has not been released, was found guilty of providing floor plans, personal details of embassy staff and their families, and information about activities at the mission between March and November 2024. The court said he received 10,000 euros ($11,700) from Russian intelligence and 0.17 bitcoin from Iranian intelligence in return.

During the trial, the defendant admitted to spying but denied aggravated espionage, saying the material he shared was not classified. He told the court his actions were motivated by opposition to Washington’s support for Israel’s military operations in Gaza.

The verdict comes amid heightened concern in Europe about foreign espionage and influence operations. Britain’s MI5 warned this week that intelligence agencies from China, Russia and Iran are targeting lawmakers to shape policy and collect information.

European authorities have also stepped up investigations into financial and cyber networks linked to Iran. In Germany, media reports said a Berlin businesswoman allegedly helped move Iranian oil revenues through front companies tied to the defense ministry. In Australia, police charged a Sydney man with sending nearly $650,000 to sanctioned Iranian banks.

Western intelligence services say Tehran has expanded its overseas operations in recent years through cyber activity, disinformation campaigns and the recruitment of local agents. Iran denies running espionage networks abroad and says it faces similar accusations meant to isolate it diplomatically.

The exhibition, organized by the US-based advocacy group United Against Nuclear Iran (UANI), featured a Shahed-136 drone recovered in Ukraine and was intended, according to the group, to highlight Tehran’s role in aiding Moscow’s military campaign. Sikorski attended the event during a visit to London for meetings with British officials.

Earlier that day, Sikorski told reporters that a recent Russian drone incursion into Polish airspace was “tactically stupid and counterproductive,” saying it had only strengthened Western resolve against Moscow. The Polish minister said the drones appeared to have been launched deliberately from Russia and coordinated with Belarus.

Mahmoud Heidari, the Foreign Ministry’s director general for Mediterranean and Eastern European affairs, summoned Polish Chargé d’Affaires Marcin Wilczek and conveyed what he called Tehran’s “strong protest” over the London event. Heidari rejected what he described as “baseless and repetitive accusations” about Iran’s drone program and expressed regret over Sikorski’s involvement.

Iran’s Foreign Ministry said the move to exhibit the drone violated diplomatic norms and repeated politically motivated allegations about Iran’s role in the Ukraine conflict.

Iran denies supplying drones for use in the war, saying it sold a limited number to Russia before the invasion began. Western governments and Ukraine say Shahed-type drones, designed in Iran and now produced in Russia under the name Geran, have become central to Moscow’s air assaults. The Financial Times reported in July that the modified drones have tripled their success rate in hitting targets.

Polish officials have not publicly commented on the summons, but Warsaw has cooperated with UANI and Ukrainian forces in transferring a similar drone to the United States earlier this year for display at a political conference attended by US President Donald Trump.