How an Iranian-linked influence campaign pivoted after Oct. 7 attack on Israel

The multi-phase campaign seeks to divide and undermine Israeli society, according to a new Recorded Future analysis.

In recent days, a purportedly pro-Israeli Telegram channel called “Tears of War” has posted dozens of messages. Interspersed with heartfelt posts pushing for the return of hostages taken as part of the Oct. 7 Hamas assault, a narrative thread is quite clear: The Israeli government is to blame for the ongoing suffering of hostages’ family members, and decisions made by Prime Minister Benjamin Netanyahu, in particular, have sabotaged any chance at a ceasefire. 

The narrative builds on broader news Monday that Hamas had agreed to an Egyptian and Qatari proposal for a ceasefire and hostage release, even as the Israeli government said the deal did not go far enough and pressed ahead with a controversial military assault in the southern Gaza city of Rafah.

Tears of War is most likely an Iranian-linked persona, exposed months ago by researchers and the Israeli government as a tool used to inflame tensions within Israel. 

But this week’s messages, relentlessly hammering the narrative, represent part of the third stage of what Recorded Future’s Insikt Group said Wednesday is a yearslong Iranian-aligned influence operation it tracks as Emerald Divide. 

Dating to 2021, the operation is working to “psychologically manipulate Israeli citizens to take real-world actions that exacerbate ideological divisions within Israeli society and undermine the Israeli government,” Sean Minor, senior threat intelligence analyst at Insikt Group, said in a new analysis shared exclusively with CyberScoop.

Emerald Divide can “dynamically shift influence operations” by continually adopting “new and innovative influence tactics and techniques,” Minor wrote, including using digital emailing campaigns hosted on a crowdfunding platform, social media reference landing pages, a geographic web-mapping platform and employing artificial intelligence-generated deepfakes, “likely increasing the ability to reach targeted audiences and drive engagement.”

Minor’s analysis tracks with previous broad observations that Iranian-linked cyber and influence operations were largely reactive in the immediate aftermath of Hamas’ Oct. 7 attack on Israeli targets. But now, seven months into what has turned into a grinding and devastating conflict, various Iranian-linked cyber and influence operations have adjusted and are using the conflict to further their respective goals.

The activity overlaps with operations tracked by Microsoft as Storm-1364. A February analysis from Microsoft’s Threat Intelligence Center highlighted the group’s ability to rapidly adjust on the fly.

“The speed at which Storm-1364 launched this campaign after the October 7 attacks highlights this group’s agility and points to advantages of influence-only campaigns, which may be faster to form because they do not need to wait on cyber activity of a cyber-enabled influence operation,” Microsoft said at the time.

Emerald Divide’s operation can be split into three phases that each have distinct objectives and corresponding narratives, according to Minor. The first phase sought to increase conflict between Israel’s ultra-Orthodox religious groups and the country’s LGBTQ+ community. The second aimed for political unrest by pitting those on the Israeli left versus those on the Israeli right, while the third and current phase sought to sow discontent among Israelis regarding the government response to the Hamas attacks.

Common through all three phases has been an ongoing shift to the messaging platform Telegram, likely in an attempt to avoid asset seizures or takedowns, Minor wrote. Another theme is the consistent use of generative AI, which “likely indicates advanced influence actors have adopted and implemented AI as a routine capability which will likely continue to improve over time with advances in technology as well as applying lessons learned through the repetition of operational employment.” 

The group did have “limited” success in getting real people to participate in protests and other actions, Minor noted, which will “likely embolden” the operators who are trying to achieve objectives while obfuscating attribution and staying below the threshold of armed conflict.

“As the Israel-Hamas conflict continues, the campaign will also likely continue taking advantage of dynamic events related to Israel’s domestic political landscape to exploit corresponding psychological vulnerabilities,” Minor concluded. New developments within Israeli society will present opportunities for further Emerald Divide pivots, he said, such as legislative elections slated for October 2026.

Researchers say Israeli government likely behind AI-generated disinfo campaign in Iran

The group leveraged dozens of social media accounts and “routinely used” AI-generated imagery and video to stoke unrest among Iran’s population, according to Citizen Lab. 

Israeli influence operation highlights global disinformation industry

Google: Iranian, regional hacking operations that target Israel remain opportunistic but focused

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems