Report: Iran increases support for Hamas with cyberattacks since Oct. 7

Iran is waging a targeted, coordinated and destructive campaign of cyberattacks and anti-Israel operations against Israel, according to a report published by the Microsoft Threat Analysis Center (MTAC) on Tuesday.

“As the Israel-Hamas war broke out on October 7, 2023, Iran immediately surged support to Hamas with its now well-honed technique of combining targeted hacks with influence operations amplified on social media; what we refer to as cyber-enabled influence operations,” MTAC wrote.

“By late October, nearly all of Iran's influence and major cyber actors focused on Israel in an increasingly targeted, coordinated, and destructive manner, making for a seemingly boundless ‘all-hands-on-deck’ campaign against Israel. Unlike some of Iran’s past cyberattacks, all of its destructive cyberattacks against Israel in this war – real or fabricated – were complemented with online influence operations.”

According to MTAC, Iran's anti-Israel operations have four main goals: “destabilization, retaliation, intimidation, and undermining international support for Israel. All four of these objectives also seek to undermine Israel and its supporters’ information environments to create general confusion and lack of trust.”

In one instance, Iranian operators reportedly posed as Israeli activist groups to create internal discord within Israel and foment internal protests against Israeli Prime Minister Benjamin Netanyahu.

“Iran’s targeting of Israel during the Israel-Hamas war has increasingly focused on stoking domestic conflict over the Israeli government’s approach to the war," the MTAC report stated.

"Multiple Iranian influence operations have masqueraded as Israeli activist groups to plant inflammatory messaging that criticizes the government’s approach to those kidnapped and taken hostage on October 7. Netanyahu has been a primary target of such messaging and calls for his removal were a common theme in Iran’s influence operations.”

The Islamic regime has achieved some degree of success in deceiving Israelis through its manipulative messaging on social media, as well as through the dissemination of bulk text messages and emails, according to the report.

“Iran has created increasingly convincing impersonations of fictitious Israeli activist organizations on the right and left of the Israeli political spectrum. Through these fake activists, Iran seeks to infiltrate Israeli communities to gain their trust and sow discord."

The report noted another example called, ‘Tears of War,’ where Iranian operatives reportedly succeeded in "convincing Israelis to hang branded 'Tears of War' banners" throughout Israel, reportedly featuring an Al-generated image of Netanyahu and calling for his removal from office.

Iranian "influence" operations continue to rely heavily on coordinated inauthentic social media organizations on the right and left of the Israeli political spectrum, using these "fake activists" to infiltrate Israeli communities "to gain their trust and sow discord,” MTAC found.

The regime reportedly seeks to amplify any collateral damage that Israel’s military operations in Gaza incurs, to weaken international support for the Jewish state.

While Iran has engaged in anti-Israel cyber activities for years, the efforts have grown exponentially since Oct. 7 compared to the past.

“The use of cyber-enabled influence operations against Israel significantly accelerated. Iran showed its preference for such attacks in 2022 when it increased the pace of such operations from roughly every other month to multiple operations a month," the MTAC report stated.

"Iran’s 10 cyber-enabled operations against Israel in October marks a new high point. This was nearly double the previous high point of six operations per month in November 2022, though these previous attacks spanned operations targeting four countries,” MTAC noted.

MTAC expects Iran’s cyber-attacks and influence operations to grow in the coming weeks and months.

“Amid the rising potential of a widening war, we expect Iranian influence operations and cyberattacks will continue to be more targeted, more collaborative and more destructive as the Israel-Hamas conflict drags on. Iran will continue to test redlines, as they have done with an attack on an Israeli hospital and U.S. water systems in late November,” MTAC concluded.