Microsoft announced on Wednesday that Iranian hackers are tracking U.S. election-related websites and media, raising concerns as the election date approaches.

The group, known as “Cotton Sandstorm” and believed to be linked to the Iranian Revolutionary Guard, has conducted thorough reconnaissance of sites in several battleground states, including scanning a U.S. news website in May.

Researchers warn that this activity indicates preparations for further direct influence operations, highlighting the group’s history of electoral interference and their increased activity as elections draw near.