Solemeini’s Revenge from Cyberspace: A Blatant Escalation

Two years ago, on 3 January 2020, the United States killed the commander of the Iranian Quds Force, Qasem Soleimani. As recently confirmed by former chief of Israel Defense Intelligence, Israel played a role in the killing.[1] For its part, Iran claims that Israel directed the operation.

This year’s anniversary of his death was marked by pro-Iranian cyber operations targeting Israel, consisting of the hacking of the platforms of Israeli media, the sending of messages directly to the cellphones of Israelis, and a hashtag campaign on Twitter.

Early in the morning on 3 January 2022, the Jerusalem Post website and the Maariv Twitter account were both hacked and temporarily defaced with threatening messages.[2] The hacking, which occurred at approximately 2 AM Israel time, has been attributed by the CheckPoint cybersecurity company to a Yemen-based pro-Iranian group.[3] While no lasting damage was done, this attack is not unprecedented.

Iran has a track record of hacking media outlets, both in Israel and the United States.[4] Taking over major news outlets could be an effective way to gain access to journalists and spread doctored stories which appear authentic. Additionally, as reported by Walla News, many Israelis received WhatsApp messages intending to demoralize them.[5] These messages originated from phone numbers from around the world, though many of them had pictures of Iranian regime officials as their profile picture.

What has received less attention is the other element of Iran’s influence operation. A Hebrew-language hashtag campaign pro-Iranian accounts promoted on Twitter, #מסר_מאיראן (“message from Iran”), numbered over twenty-seven thousand tweets and was briefly trending in Israel. While at first this seems like a sizeable undertaking, the numbers tell a different story.

The campaign consisted of less than two-thousand original tweets, and over twenty-five thousand retweets. Of the over seven-thousand accounts involved in the campaign, over 80% were only retweeting tweets with that hashtag and did not create any original content.

The height of Twitter activity came at approximately 2 AM, the same time when the hacking of the Jerusalem Post occurred. By ramping up the campaign at a time of day when Hebrew-language Twitter is less active, it had a better chance to reach trending status, as it did succeed in doing. Trends are pushed by the Twitter algorithm onto the home page of users, thus providing the oppurtunity to make an impression on the Israeli public.

According to the Talkwalker application, the potential reach of the tweets with the hashtag #מסר_מאיראן (“message from Iran”) totaled over 23 million Twitter users.

Amongst the original tweets, the most popular themes were the promotion of the idea that a final status solution should come by way of referendum, where all Palestinians descendent from those who resided in Mandatory Palestine (including refugees in the diaspora) vote on the identity of the land between the Jordan River and the Mediterranean Sea.

This idea was introduced by Iran’s Supreme Leader Ayatollah Ali Khamenei’s Quds Day speech in May 2020 and was accompanied by graphics depicting the Dome of the Rock, Al-Aqsa Mosque, and the Temple Mount under Iranian and Palestinian control.[6]

Other popular themes included criticizing the IDF for internal issues which have been in the news lately, such as the subpar food or the horrifying revelations of sexual misconduct by officers; accusations that Israel is committing war crimes against Palestinians; pushing the idea that Israel is failing to provide safety and security for its citizens; and accusations regarding settler violence in the West Bank. These messages were very similar to those sent to Israelis via WhatsApp, with some of those messages also containing the hashtag #מסר_מאיראן.

To boost these tweets and draw attention to the hashtag, those behind the campaign targeted and tagged leading Israeli public figures, as well as replied to tweets by prominent Israelis. The coordination and potential automation of the campaign is clear, as the tweets and the hashtag were in Hebrew, not exactly a language commonly spoken in Iran. Furthermore, there was an abnormally high number of accounts which consistently retweeted at high intervals.

Approximately 25% of the accounts involved with the campaign retweeted at least two tweets within one minute of each other.[7] Another suspicious element is the noticeable use of relatively new accounts in the campaign. When looking at when both accounts which only tweeted original tweets and those accounts that only retweeted, there are noticeable peaks at similar points in time. This points to coordinated action beyond the hashtag campaign itself.

The themes which received the most engagement (retweets and likes) were the idea that the final status solution should come via a referendum, support for all types of resistance for the Palestinian people, and domestic issues in Israel such as domestic violence, settler violence, and Ashkenazi-Mizrachi relations.

What is notable about the campaign is that it was easily identifiable as a pro-Iranian campaign. The accounts taking part identify as Iranians, and many of the tweets included Iranian flags. This is clearly a brazen attempt by Iran to intimidate Israel and take advantage of sensitive topics in Israeli society while also emphasizing their ability to manipulate the discourse on social media. This is in contrast from past campaigns against Israel attributed to Iran, which were made up of profiles purporting to be Israeli and infiltrated political groups with the goal of influencing political discussion in Israel.[8]

During May’s Operation "Guardian of the Walls", a campaign reportedly originating in Iran operated Twitter accounts identifying as Israelis and spreading the narrative that Israelis are not native to the land, that Israel was unable to provide security to its citizens, and that the solution is emigration.[9] This campaign may have been aimed at boosting Hamas’s image abroad. Additionally, Hezbollah has also promoted the idea that Jewish Israelis should emigrate from Israel and “return” to Europe.[10]

This campaign is more similar to the phenomenon we saw following the death of Soleimani, when the hashtag #HardRevenge was trending. That campaign also went viral thanks to a disproportionate number of retweets, with the involved accounts openly identifying as Iranian.[11] In fact, in comparing the users involved in the two campaigns, there is a slight overlap. While this overlap is statistically insignificant (<1%), this aspect should not be ignored.

From this past campaign it is apparent that Iran is well acquainted with Israeli society and burning domestic issues which divide the country. While it is highly doubtful that the campaign discussed here exacerbated these tensions, Iran has the potential capability of capitalizing on domestic discord and even triggering instability. Alternatively, the capabilities shown off in this campaign could be used to create false perceptions of Israeli society, to gain support for Israel’s adversaries abroad.

The foreign interference in domestic affairs is a challenge for social media platforms, and the fact that many of the offending tweets remain online is something which must be dealt with by Twitter. Another takeaway from this year’s anniversary of Qasem Soleimani’s death is the ability of pro-Iranian cyber groups to coordinate a campaign across different mediums. While no elements of the attack were overly successful, the potential damage is clear.