Iran Expanding Cyber Activity Against Israel, Microsoft Warns
“Amid the rising potential of a widening war, we expect Iranian influence operations and cyberattacks will continue to be more targeted, more collaborative, and more destructive”
Mandi Kogosowski
| 15/02/2024
REUTERS/Dado Ruvic/Illustration
A new report published last week by the Microsoft Threat Analysis Center confirms that Iran and its proxies and affiliates have expanded and accelerated their anti-Israel operations in the cyber sphere since the war with Hamas erupted on October 7th.
Following Hamas’ massacre in southern Israel, Iran-affiliated cyber-enabled influence operations went from roughly one operation every other month in 2021 to 11 in October 2023 alone, the report notes. As the war progressed, Iran-linked actors expanded their geographic scope and also increased collaboration efforts, thus achieving greater specialization and effectiveness.
The first phase of Iran’s cyber-influence campaigns included various claims regarding cyber attacks they have allegedly committed against Israel in conjunction with Hamas’ attacks and also leaked data. However, Microsoft’s researchers revealed that despite these claims, many “attacks” in the early days of the war were either leaking old material, using pre-existing access to networks, or simply false.
The researchers note that, while in early October Iran’s actions were reactive and somewhat chaotic – by the end of the month, nearly all of its influence and major cyber actors were targeting Israel. The attacks became increasingly sophisticated, targeted and destructive, deploying networks of social media “sockpuppet” accounts. They refer to this as an “all hands on deck” approach.
Iran and affiliated actors are trying to exacerbate Israel’s domestic political and social rifts, often focusing on the Israeli government’s approach to the hundreds of hostages taken by Hamas into Gaza and masquerading as peace-seeking activist groups criticizing the Israeli government, the report notes. Israeli Prime Minister Netanyahu is the primary target of such messaging, often calling for his removal from office.
Iran’s operations also aim to undermine Israeli security, intimidate Israel’s citizens and international supporters and threaten the families of IDF soldiers. Sockpuppet accounts spread messaging on X that the “IDF does not have any power to protect its own soldiers.” Another method for Iran to create chaos through influence campaigns includes messages that seek to weaken international support for Israel by highlighting the damage caused by Israel’s attacks on Gaza.
“Amid the rising potential of a widening war, we expect Iranian influence operations and cyberattacks will continue to be more targeted, more collaborative, and more destructive as the Israel-Hamas conflict drags on,” the researchers note. “Iran will continue to test redlines, as they have done with an attack on an Israeli hospital and U.S. water systems in late November.”
“Amid the rising potential of a widening war, we expect Iranian influence operations and cyberattacks will continue to be more targeted, more collaborative, and more destructive”
REUTERS/Dado Ruvic/Illustration
A new report published last week by the Microsoft Threat Analysis Center confirms that Iran and its proxies and affiliates have expanded and accelerated their anti-Israel operations in the cyber sphere since the war with Hamas erupted on October 7th.
Following Hamas’ massacre in southern Israel, Iran-affiliated cyber-enabled influence operations went from roughly one operation every other month in 2021 to 11 in October 2023 alone, the report notes. As the war progressed, Iran-linked actors expanded their geographic scope and also increased collaboration efforts, thus achieving greater specialization and effectiveness.
The first phase of Iran’s cyber-influence campaigns included various claims regarding cyber attacks they have allegedly committed against Israel in conjunction with Hamas’ attacks and also leaked data. However, Microsoft’s researchers revealed that despite these claims, many “attacks” in the early days of the war were either leaking old material, using pre-existing access to networks, or simply false.
The researchers note that, while in early October Iran’s actions were reactive and somewhat chaotic – by the end of the month, nearly all of its influence and major cyber actors were targeting Israel. The attacks became increasingly sophisticated, targeted and destructive, deploying networks of social media “sockpuppet” accounts. They refer to this as an “all hands on deck” approach.
Iran and affiliated actors are trying to exacerbate Israel’s domestic political and social rifts, often focusing on the Israeli government’s approach to the hundreds of hostages taken by Hamas into Gaza and masquerading as peace-seeking activist groups criticizing the Israeli government, the report notes. Israeli Prime Minister Netanyahu is the primary target of such messaging, often calling for his removal from office.
Iran’s operations also aim to undermine Israeli security, intimidate Israel’s citizens and international supporters and threaten the families of IDF soldiers. Sockpuppet accounts spread messaging on X that the “IDF does not have any power to protect its own soldiers.” Another method for Iran to create chaos through influence campaigns includes messages that seek to weaken international support for Israel by highlighting the damage caused by Israel’s attacks on Gaza.
“Amid the rising potential of a widening war, we expect Iranian influence operations and cyberattacks will continue to be more targeted, more collaborative, and more destructive as the Israel-Hamas conflict drags on,” the researchers note. “Iran will continue to test redlines, as they have done with an attack on an Israeli hospital and U.S. water systems in late November.”
