Russian online propaganda campaign to fuel divisions within Israel uncovered

The Israeli cyber companies ClearSky and Sentinel One announced on Thursday that they had uncovered a Russian propaganda and disinformation campaign to fuel divisions within Israeli society.

At the center of the hostile Russian Doppelgänger NG cyber campaign is Fancy Bear or APT28, an obscure Russian IT entity reportedly linked to the Russian military intelligence agency GRU. The subversive anti-Israel campaign is allegedly similar to previous Russian online propaganda campaigns that targeted Western democracies, such as the United States, Great Britain and France.

ClearSky and Sentinel One have been monitoring the Russian campaign since November 2023. The disinformation campaign efforts were reportedly designed to spread pro-Russian sentiments concerning the Ukraine conflict and to instill fear about Israel becoming more isolated in the international arena.

The Russian cyber campaign allegedly attempted to influence Israelis to support the Russian military war effort by falsely claiming that Ukraine cooperates with the terror organization Hamas. The Russian campaign created several fake websites designed to influence Israeli public opinion, including one that was intended to imitate the influential Israeli news outlet Walla.

ClearSky CEO Boaz Dolev noted that the Russian cyber campaign aims to assist Moscow’s Middle Eastern allies, isolate Israel and promote pro-Russian sentiments in the Ukraine conflict.

"We see efforts to sway the course of the war and amplify divisions. The Russians aim to aid their regional allies (Iran and Syria), undermine Israel, and oppose the West and Ukraine. They desire a vulnerable Israel," Dolev said.

He emphasized the importance of a coordinated effort to confront the hostile Russian campaign.

"It's not entirely clear if the authorities have been alerted to this activity. Nonetheless, the fight against such campaigns necessitates a joint effort from governing bodies, social media corporations, and an alert public capable of spotting manipulative tactics."

ClearSky cyber experts assessed that such an extensive campaign requires considerable investments in human resources and technology.

"Sustaining an ongoing campaign of this breadth demands substantial investment in human resources, technology and IT infrastructure," the ClearSky report stated.

"The extent of investment in such a large-scale campaign suggests state sponsorship," the report stated.

Russia's campaign to undermine Israel is reportedly part of the “Spirit of the Healers,” a network consisting of some 150 domains that also target the United States, Germany, France and Ukraine.

Iran is another anti-Israel player with considerable cyber capabilities. In early February, Microsoft Threat Analysis Center (MTAC) announced that Iranian-affiliated hackers have been escalating their cyber-attacks against Israel since the Hamas invasion and massacre on Oct. 7.

“As the Israel-Hamas war broke out on October 7, 2023, Iran immediately surged support to Hamas with its now well-honed technique of combining targeted hacks with influence operations amplified on social media; what we refer to as cyber-enabled influence operations,” MTAC stated.

MTAC concluded that the purpose of the Iranian propaganda campaign is “destabilization, retaliation, intimidation, and undermining international support for Israel. All four of these objectives also seek to undermine Israel and its supporters’ information environments to create general confusion and lack of trust.”