Meta Dismantles Iranian and Hezbollah Influence Operations Targeting Israel

Meta’s Threat Disruption Center two weeks ago exposed influence operations backed by Iran and Hezbollah that targeted Israel, taking down several accounts on the company’s Instagram and Facebook platforms. While Meta dismantled the operations before their deceptive content could garner significant attention from users, they reflect how Iran and its terrorist proxies have waged numerous information campaigns against Israel since Hamas’s atrocities on October 7, 2023. Meta warned that after Russia, Iran conducts the most covert influence operations on its platforms.

Iran’s Failed Campaign

Meta attributed the activity originating in Iran to threat actors backed by Iran’s Islamic Revolutionary Guard Corps (IRGC). Meta noted that weeks before the publication of its latest report, the FBI and the Israel National Cyber Directorate issued an advisory linking the activity that Meta observed with IRGC-controlled front company Aria Sepehr Ayandehsazan (also known as Emennet Pasargad). This group was responsible for directly targeting Israeli athletes during this summer’s Paris Olympics with threatening text messages and emails, according to the FBI.

Iran also created a website that masqueraded as The Jerusalem Post news outlet, Meta warned, aiming to trick readers into believing the content is genuine news reporting. Iran utilized generative artificial intelligence throughout this operation, but Meta concluded that the AI only marginally enhanced the efficacy of the operation.

Hezbollah’s Phony Media Operations

Meta attributed the other operation to threat actors based in Lebanon with ties to the pro-Hezbollah al-Mayadeen media outlet and the Iran-linked LuaLua TV network. The operation used fake sites claiming to be Israeli media outlets Dofek, Israel in a Minute, and Halalom Israel; ran accounts on various social media platforms, including TikTok, Facebook, Instagram, Twitter, and others; and spent approximately $9,000 in ads on Facebook and Instagram. Across three fictitious news entities with unique branding and logos, Hezbollah pushed content in Hebrew promoting narratives about the supposed weakness of Israeli society, including false stories about food shortages in Israel.

The Bigger Picture of Iranian Hostile Influence

Iran’s hostile influence efforts targeting Israel are multifaceted, multiplatform, and often more effective than other influence operations targeting Western states, occasionally leading Israelis to inadvertently promote their operations. Iran utilizes social media and messaging application-oriented influence operations to target Israelis on popular platforms in Israel. In addition, Iran carries out cyber-enabled operations aimed at exerting influence over or instilling fear in Israeli victims.

Past examples of Iranian cyber-enabled influence operations include conducting ransomware attacks against Israeli companies; hacking and leaking sensitive personal information of Israeli citizens online; and carrying out DDoS (Distributed Denial of Service) attacks to take down Israeli sites. Most of this activity occurs via Iran-aligned hacktivist front groups. Iran invested significant resources in this field of activity prior to, but especially after, Hamas launched its brutal war against Israel on October 7, 2023, according to Microsoft.

U.S. Must Do More to Combat Influence Operations

While Meta deserves commendation for taking action against influence operations, the U.S. government must also do more to protect its own citizens and its allies. Washington and Jerusalem should strengthen collaboration in combatting foreign malign influence by formalizing cooperation agreements in counter foreign-interference efforts. These agreements can and should include formalized workflows and policies, including regulatory know-your-customer frameworks for internet hosting services and commercial AI tooling, and other standards and norms-setting for counter-interference best practices.

Creating an official center for international cooperation in the counter-interference space is also critical, as most counter-interference investigations in the United States and abroad are the result of closed-source, classified intelligence-gathering and analysis. Such a center could utilize open-source intelligence for including shared investigations, public advisories, and other public-facing work, similar to France’s VIGINUM, which publishes unclassified, technical, and in-depth investigations into foreign influence networks.

Ari Ben Am is an adjunct fellow at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD). For more analysis from the author, CCTI, and FDD, please subscribe HERE. Follow Ari on X @ari_ben_am. Follow FDD and CCTI on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on foreign policy and national security.