How an Iran-linked influence campaign pivoted after the Oct. 7 attack on Israel

In recent days, a supposedly pro-Israel Telegram channel called “Tears of War” has posted dozens of messages. Interspersed with heartfelt posts calling for the return of the hostages captured in the October 7 Hamas attack, the narrative is clear: the Israeli government supports the continued suffering of the hostages’ family members and the decisions Prime Minister Benjamin Netanyahu in particular has sabotaged any chance of a ceasefire.

The narrative builds on broader news on Monday that Hamas had agreed to an Egyptian and Qatari proposal for a ceasefire and the release of hostages, although the Israeli government said the deal did not go far enough and called for a controversial military attack in the city South of the Gaza Strip was driven by Rafah.

Tears of War is most likely an Iran-linked individual who was exposed months ago by researchers and the Israeli government as a tool to inflame tensions within Israel.

But this week’s messages, relentlessly reinforcing the narrative, represent part of the third phase of what Recorded Future’s Insikt Group said Wednesday: a years-long, Iran-aligned influence operation it calls the Emerald Divide.

The operation dates back to 2021 and aims to “psychologically manipulate Israeli citizens to take real-world actions that exacerbate ideological divisions within Israeli society and undermine the Israeli government,” said Sean Minor, senior threat intelligence analyst at Insikt Group, in a new analysis shared exclusively with CyberScoop.

Emerald Divide can “dynamically transform influence operations” by continually adopting “new and innovative influence tactics and techniques,” Minor wrote, including the use of digital email campaigns hosted on a crowdfunding platform, social media reference pages, a geographic web mapping platform and employment Artificial intelligence-generated deepfakes “are likely to increase the ability to reach audiences and drive engagement.”

Minor’s analysis is consistent with previous general observations that Iran-linked cyber and influence operations were largely reactive in the immediate aftermath of Hamas’ October 7 attack on Israeli targets. But now, seven months into what has become a grueling and devastating conflict, various Iran-linked cyber and influence operations have adapted and are using the conflict to advance their respective goals.

The activity overlaps with operations tracked by Microsoft as Storm-1364. A February analysis from Microsoft’s Threat Intelligence Center highlighted the group’s ability to adapt quickly.

“The speed with which Storm-1364 launched this campaign after the October 7 attacks underscores the agility of this group and points to the benefits of purely influential campaigns, which may be able to be launched more quickly because they are not based on cyber activity of a cyber attack. activated influence operation,” Microsoft said at the time.

According to Minor, Emerald Divide’s operation can be divided into three phases, each with different goals and corresponding narratives. The first phase aimed to exacerbate the conflict between Israel’s ultra-Orthodox religious groups and the country’s LGBTQ+ community. The second phase was aimed at political unrest by pitting the Israeli left against the Israeli right, while the third and current phase aimed at sowing discontent among Israelis over the government’s response to the Hamas attacks.

What all three phases had in common was a rolling shift to the Telegram messaging platform, likely in an attempt to avoid asset seizures or deletion, Minor wrote. Another theme is the consistent use of generative AI, which “likely indicates that advanced influence actors have adopted and implemented AI as a routine capability that is likely to continue to improve over time with technological advances as well as the application of lessons learned from repeating operational missions.” .” .”

The group has had “limited” success in getting real people to participate in protests and other actions, Minor noted, which will “likely embolden” actors trying to achieve goals while obscuring attributions and below the threshold of an armed one conflict.

“As the Israel-Hamas conflict continues, the campaign will likely continue to exploit dynamic events related to Israel’s domestic political landscape to exploit related psychological vulnerabilities,” Minor concluded. New developments in Israeli society would provide opportunities for further turning points in the Emerald Gap, he said, such as parliamentary elections scheduled for October 2026.