Pro-Hamas Cyber Groups Target Social Media with Disinfo Designed to Incite Antisemitism

It was a routine Zoom class for the kids in the Israeli Beit Rivkah School when, suddenly, terrified students saw their teacher disappear and replaced by a man holding an automatic rifle and wearing military-style attire.

“Today, a terrorist entered the Zoom of the Beit Rivkah School, took the teacher out of the meeting, and scared the girls,” the Israeli Education Ministry said in a WhatsApp message on October 11.

Following the devastating Hamas strike on October 7, the Israeli education system returned to the pandemic-style distance learning using video call software Zoom. The education ministry prohibited the schools from using Zoom after the Beit Rivkah School incident and recommended switching to Google Meet software instead.

Israel has been facing a major escalation of low-level cyberattacks in the last few weeks, the U.S. Cybersecurity and Infrastructure Security Agency said on October 12, adding that the U.S. is “working in partnership with Israeli cyber forces to thwart cyberattacks.”

These low-level attacks are “politically motivated” and involve hacktivist groups on both sides of Hamas-Israel conflict, Axios reported on October 10, citing the CyberKnow security research group.

“At least 58 groups” are involved in the conflict, with about 48 “working against Israel” and some 10 supporting Israel, the CyberKnow report said.

They include a group called Anonymous Sudan, which claimed responsibility for taking down the website of the influential Jerusalem Post.

Another pro-Palestine group, AnonGhost, exploited vulnerabilities in the Red Alert application to send fake alerts about Israel launching a nuclear attack. The app is trusted by users worldwide as it alerts of rocket launches in real-time.

There was also the hacking of two smart billboards near Tel Aviv, in which a commercial video was replaced with pro-Hamas, anti-Israeli footage on October 12.

But not all recent hacks are “low-profile.” The ZeroFox cybersecurity firm reported that hackers were able to compromise data of the Israeli Defense Forces and the Israel Security Agency. Personnel files, photographs and access to social media profiles were subsequently advertised for sale on the Russian-language dark web forum RAMP.

The CSO cybersecurity consulting firm reported that both AnonGhost, Anonymous Sudan and other hacktivist groups like CyberAv3ngers and Killnet, are aligned with either Iran or Russia.

On October 15, the Ghost of Palestine hacktivist group called for “hackers worldwide” to join it in attacking Israeli and U.S. public and private infrastructure, Axios reported.

As part of this “hacktivist mobilization” campaign, Hamas increasingly istargeting social media users and groups with disinformation designed to incite hatred toward Israel. Decade-old videos and photos showing the suffering of Syrian children during that country’s civil war are becoming viral, pushed by anonymous pro-Hamas users and falsely labeled as current footage from Gaza.

The scope of disinformation that pro-Hamas hacktivist groups and aligned users are disseminating across social media platforms is alarming senior European Union officials told the EuroActiv news site.

Two EU politicians demanded that X (formerly Twitter) and TikTok curb the anti-Israeli disinformation, and even “contacted the relevant law enforcement authorities and the Europol” to identify and bring online criminals to justice. (Europol is short for European Union police force).

X said it had removed hundreds of newly created “Hamas-affiliated” accounts for spreading hateful and antisemitic content.

In some target groups – particularly young, disenfranchised Muslims – such disinformation has real-world implications.

For example, The Associated Press cited French Interior Minister Gerald Darmanin as saying the country’s intelligence services saw a possible link between the Israel-Hamas war and the October 13 attack by a young Chechen immigrant, who stabbed to death a teacher at his former high school in northern France and wounded three other people.

The news agency quoted French intelligence services as saying that the attacker “had been under surveillance since the summer on suspicion of Islamic radicalization.”