Microsoft published a new report Wednesday morning stating that Iran has significantly intensified its cyber activity against Israel since October 7. The report, prepared by Microsoft's Cybersecurity Intelligence Center, presents a worrisome picture of extensive Iranian activity, which included targeted intrusions, operations on social networks, use of new technologies like artificial intelligence, and dissemination of fake news and propaganda.
These objectives seek to undermine Israel and its supportive information environment in order to create general confusion and mistrust. Among other things, Microsoft reports a nearly twofold increase in cyberattacks and their impact on Israel in the weeks following the war, as well as a 30% increase in Iranian disinformation consumption in English-speaking countries that support Israel, including the United States. Additionally, no evidence was found of coordination between Iranian cyberattacks and Hamas on the day of the attacks on Israel.
During the first week of the war, there was a 42% increase in traffic to sites where posts and articles were published by Iranians - following an increase in Iranian cyberattacks and the publication of articles and advertisements on various platforms. This increase was mainly felt in English-speaking countries that support the United States and Israel.
Additionally, the number of active cyber groups operating in Israel increased from 9 in the first week of the war to 14 in the second week. cyberattacks increased from one attack every two months in 2021 to 11 attacks in just October. "As the war progressed, especially from the end of November in parallel to the rocket attacks, Iranian groups expanded their activities to additional countries that support Israel, such as Albania and Bahrain, and to companies conducting business with Israel," Microsoft explains.
Attackers seek to divide Israel
The report also adds that Iran aims to exacerbate the political and social divisions in its targets, often focusing on the Israeli government's approach to the 240 Hamas captives in Gaza and pretending to be active groups advocating for peace who criticize the Israeli government. "Prime Minister Netanyahu is a central target for such messages, and often calls are made for his removal," it is written.
As a reminder, Iran has repeatedly succeeded in recruiting unaware Israelis to participate in activities that deceive its covert operations. One such operation is called "The Tears of War," in which Iranian intelligence agents convinced Israeli activists to hang posters with the headline "The Tears of War" in neighborhoods throughout Israel. According to the report, the images were also created by artificial intelligence.
According to the research groups of Microsoft, it is estimated that two groups connected to the Iranian intelligence agency collaborated in a cyberattack on Israel in late October, as well as on a country that supports Israel - Albania. The report suggests that the goal is to influence English speakers and promote hate speech against Israel on social networks.
Despite some reports in the Iranian state media, Iranian cyber and propaganda entities were initially reactive during the conflict between Israel and Hamas. Microsoft teams found that Iranian communication channels published misleading details about alleged attacks, and Iranian groups reused old materials from previous operations and exaggerated the scope and overall damage of cyberattacks.
For example, in early December, Iran disrupted online television services and replaced them with a fake news video featuring a fake news anchor apparently created by artificial intelligence. "This was the first Iranian influence operation in which AI played a key role in shaping its messages, and it is just one example of the rapid and significant expansion of Iranian activities since the beginning of the conflict between Israel and Hamas. The disruption reached audiences in the United Arab Emirates, the United Kingdom, and Canada," the report stated.
In fact, the research found that the most significant increase in consumption of Iranian news occurred in the United States and English-speaking countries allied with the US. In the first week of the conflict, there was a documented increase of 42%. This increase was particularly noticeable in the United States and English-speaking allied countries (the UK, Canada, Australia, New Zealand), indicating Iran's ability to reach Western audiences with its reporting on conflicts in the Middle East.