# Incident I00086: #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media
* **Summary:** “This report investigates a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023. By using digital forensic strategies and network analysis, this research unearths the magnitude of knowledge, organization, and resource expenditure of the campaign. Network analysis indicates the campaign includes thousands of accounts. Though unable to trace the exact origins, phone numbers belonging to accounts have been linked to Jordan and Egypt, and it is alleged that many of the tactics are likely inspired by previous Iranian campaigns. Advanced and novel tactics are unearthed in this report, including evading reverse image search, strategic hashtag use, and meticulous crafting of fake accounts and engagements. These tactics signify a nuanced approach to creating a disinformation network aimed at manipulating public opinion in Israel. This report also examines Meta’s responsibilities, highlighting concern over its inaction and staggered transparency. This report contributes crucial insights regarding influence campaigns in Israeli digital spaces and provides valuable learnings for social media platforms in combating disinformation campaign strategies and efforts.”
* **incident type**:
* **Year started:**
* **Countries:** ,
* **Found via:**
* **Date added:**
| Reference | Pub Date | Authors | Org | Archive |
| --------- | -------- | ------- | --- | ------- |
| [https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/](https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/) | 2024/02/21 | Uri Klempner | Reichman University | [https://web.archive.org/web/20240528220853/https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/](https://web.archive.org/web/20240528220853/https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/) |
| Technique | Description given for this incident |
| --------- | ------------------------- |
| [T0015 Create Hashtags and Search Artefacts](../../generated_pages/techniques/T0015.md) | IT00000302 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”, which posted hashtags alongside campaign content (T0015: Create Hashtags and Search Artefacts):
“The accounts post generic images to fill their account feed to make the account seem real. They then employ a hidden hashtag in their posts, consisting of a seemingly random string of numbers and letters.
“The hypothesis regarding this tactic is that the group orchestrating these accounts utilizes these hashtags as a means of indexing them. This system likely serves a dual purpose: firstly, to keep track of the network’s expansive network of accounts and unique posts, and secondly, to streamline the process of boosting engagement among these accounts. By searching for these specific, unique hashtags, the group can quickly locate posts from their network and engage with them using other fake accounts, thereby artificially inflating the visibility and perceived authenticity of the fake account.” |
| [T0085.008 Machine Translated Text](../../generated_pages/techniques/T0085.008.md) | IT00000301 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.
“A conspicuous aspect of these accounts is the likely usage of machine-translated Hebrew. The disjointed and linguistically strange comments imply that the CIB’s architects are not Hebrew-speaking and likely translate to Hebrew using online tools. There’s no official way to confirm that a text is translated, but it is evident when the gender for nouns is incorrect, very unusual words or illogical grammar being used usually lead to the conclusion that the comment was not written by a native speaker that is aware of the nuances of the language.”
In this example analysts asserted that accounts were posting content which had been translated via machine (T0085.008: Machine Translated Text), based on indicators such as issues with grammar and gender. |
| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000296 Accounts which were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023” were presenting themselves as locals to Israel (T0097.101: Local Persona):
“Unlike usual low-effort fake accounts, these accounts meticulously mimic young Israelis. They stand out due to the extraordinary lengths taken to ensure their authenticity, from unique narratives to the content they produce to their seemingly authentic interactions.” |
| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000297 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.
“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”
This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). |
| [T0144.002 Persona Template](../../generated_pages/techniques/T0144.002.md) | IT00000298 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.
“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”
This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). |
| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | IT00000300 “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.
[...]
“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”
In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). |
| [T0145.006 Attractive Person Account Imagery](../../generated_pages/techniques/T0145.006.md) | IT00000299 “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.
[...]
“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”
In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). |
DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW