While the Trump administration has highlighted the threat Iran poses to the U.S. election, a different foe — Russia — remains the more potent adversary, and has in recent months stolen data from at least two county systems in California and Indiana, according to U.S. officials.

In one case, no election data was known to have been taken. In the second, a small sample of publicly available voter information was stolen, the officials said.

That level of activity pales in comparison with 2016, when Russia spectacularly hacked and leaked Democratic emails, disrupting a convention and Hillary Clinton’s campaign, as the Kremlin also mounted an ambitious effort on social media to try to stoke discord in the United States.

Nonetheless, experts are more worried about Moscow, and somewhat perplexed at the attention being paid by the Trump administration to Iran, whose capabilities are far less formidable.

The nation’s top intelligence official hastily called a news conference on Wednesday evening to alert the public to the threat he said Tehran poses to the Nov. 3 election. Director of National Intelligence John Ratcliffe had comparatively little to say about Russia, whose efforts to undermine U.S. democracy President Trump has repeatedly downplayed.

Officials remain concerned that the Kremlin poses the greater threat of election interference — and they fear that Moscow might still try to pull off a surprise.

“Overall, Russia is still a much bigger danger than Iran,” said one intelligence official, who, like others, spoke on the condition of anonymity because of the matter’s sensitivity.

Iran nonetheless carried off the first foreign influence operation directed against actual voters. In faked, menacing emails sent to Democrats in swing states, people claiming to be from a far-right, pro-Trump group called the Proud Boys instructed voters to cast their ballots for Trump or “we will come after you.”

A spokesman for the Iranian mission to the United Nations, Alireza Miryousefi, said Iran has no interest in interfering in the U.S. election and no preference for the outcome. “The U.S. must end its malign and dangerous accusations against Iran,” Mir­yousefi said.

From a podium at FBI headquarters, Ratcliffe said the emails were an attempt by Iran to “cause confusion, sow chaos and undermine your confidence in American democracy.” He also claimed, without citing specific evidence, that the operation was an effort to “damage President Trump.”

Though Iran’s actions were fairly amateurish, according to analysts, they nonetheless riled Democratic voters who received the emails. “In the grand scheme of things, it was pretty minor,” one official said. “But you had to nip it in the bud.”

Ratcliffe also mentioned Russia briefly, mainly to note that it had obtained voter registration information, much of which is publicly available.

The emphasis on Iran is consistent with the Trump administration’s animosity toward Tehran, whose economy it has squeezed through crippling sanctions aimed at limiting the regime’s nuclear program and curbing its actions in the region.

On Thursday, the administration imposed sanctions on the Bayan Rasaneh Gostar Institute, which is linked to the Islamic Revolutionary Guard Corps, for interfering in the 2020 election. The institute, a U.S. official said, was behind the faked emails to voters. The Treasury Department also levied sanctions for election interference on four other entities, including the IRGC.

The sanctions levied Thursday were in the works for at least two months, but the events of this week led the administration to speed up the announcement, a second official said. It marks the first time a 2018 executive order permitting sanctions for election interference has been used against Iran.

The measures seem aimed mostly at sending a message, since the IRGC is already heavily sanctioned, and European and other banks already do not deal with it or its front companies.

Also on Thursday, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that Iranian government hackers are “creating fictitious media sites and spoofing legitimate media sites” to spread anti-American propaganda; misinformation about voter suppression and voter fraud; and U.S. voter registration data that they have obtained.

These hackers, the advisory said, “are likely intent on influencing and interfering with the U.S. elections to sow discord among voters and undermine public confidence in the U.S. electoral process.”

CISA and the FBI also issued another alert, warning about the Russian hacking group known as Berserk Bear, which works for the KGB successor agency FSB and which compromised the networks of the two U.S. counties. The group has also targeted dozens of state and local government and aviation networks, the agencies said. The most skilled of the Russian hacking teams, it is known inside the FSB as Center 16.

Ratcliffe on Wednesday evening seemed eager to push out the announcement about Iran as soon as possible. The emails were sent Tuesday and the intelligence community concluded that Iran was behind them by Wednesday. Ratcliffe made his statement that evening, taking no questions.

FBI Director Christopher A. Wray participated in the announcement, but refrained from addressing the Iranian operation. Instead, he sought to reassure the public that the FBI would not tolerate foreign interference or any criminal activity that “threatens the sanctity of your vote.”

Wray has drawn Trump’s ire for, among other things, testifying candidly that Russia has been “very active” in trying to influence the election by sowing divisiveness and seeking to “denigrate” Democratic nominee Joe Biden.

Wray’s FBI has sought to walk a fine line between wanting to be transparent about foreign threats and not appearing to be engaging in actions that could be perceived as political so close to the election. Ratcliffe’s language was viewed by some in the intelligence community as alarmist and political, while Wray sought to reassure the public that the election system was still secure.

Also present at the Wednesday evening news conference were Assistant Attorney General John Demers and CISA Director Christopher Krebs. Neither of them spoke.

“Ratcliffe opted to hold a news conference rather than issue a written statement in order to generate more public attention and awareness about the threat, and to send a message to U.S. adversaries, in order to deter future aggression,” a senior intelligence official said.

John Hudson and Josh Dawsey contributed to this report.