January 4, 2022
Prime Minister Naftali Bennett has spoken with the head of the Shin Bet, asking that the security agency investigate a network of fake accounts ostensibly tied to Iran that targeted activists in opposition leader Benjamin Netanyahu’s Likud party, according to a Friday report.
Bennett told Shin Bet chief Ronen Bar that he wants the cases to be investigated thoroughly, Channel 12 news reported.
This follows a Channel 12 report that aired Wednesday claiming a group of Iranian hackers were behind the fake accounts, but did not offer definitive proof tying them to Tehran.
The hackers had contacted Likud members and offered to help organize protests, fund demonstrations, prepare banners, and open groups on the Telegram messaging app, in an apparent effort to stir unrest, according to internet watchdog FakeReporter, which first uncovered the effort.
In an exchange published by Channel 12, an alleged Iran-linked online imposter urged a Likud activist to organize a protest against the governing coalition in Tel Aviv.
The account asks the organizer, Orly Lev, about funding and printing banners. Lev said she did not realize at the time she was corresponding with an imposter.
According to the report, the back-and-forth exchange went on for weeks, with the hacker offering help and services and trying to get in touch with people closer to Netanyahu, including his son, Yair.
The hacker offered help with graphics design and sent the organizer a sample poster.
In one exchange, Lev offered advice on a design, saying, “I would take off the part that says protest of rage. It sounds like an Arab thing. I would add an Israeli flag. And the map of Israel at the top doesn’t have the Golan.”
The hacker replies, “We’ll make an amazing poster. Will you pass it to Yair?”
Lev said Yair Netanyahu “was not connected to this.” She told Channel 12 that the hackers thought she was in touch with Yair Netanyahu and had tried to reach him through her several other times.
The report did not say what platform the two used to converse or when the exchange took place, but the alleged imposter mentions having been to a September 23 rally in Tel Aviv which Lev posted about on Facebook.
“They are not coming to hurt the Likud. They’re coming to destroy Israel,” said Achiya Schatz, CEO of FakeReporter.
In July, FakeReporter released a report on a similar effort by alleged Iranian hackers to stir up anti-Netanyahu sentiment in the leadup to the 2021 election, including by impersonating Black Flag protesters and reaching out directly to Israelis via small WhatsApp groups and over other encrypted messaging apps.
“Iranian-based threat actors are some of the more persistent and well-resourced groups attempting to operate online, including on our platform,” a Facebook spokeswoman told The New York Times at the time.
As with the previous campaign, the alleged pro-Netanyahu hackers used a web of fake accounts with Hebrew names and generic photos stolen off the internet to reach out to Israeli directly, using them to amplify their messaging.
At least 10 fake profiles on Facebook shared memes and other political content, managing to infiltrate 50 Likud groups, 33 general political groups and nine anti-Netanyahu groups, giving them exposure to over a million Israelis on the social media platform, Channel 12 said.
Lev told Channel 12 she shared a post from one of the allegedly fake profiles calling for a protest against Prime Minister Naftali Bennett minutes after it was sent to her.
She later grew increasingly suspicious of the account when those behind it began offering money to put together the protest.
“The direct approach to Israeli citizens, made through internal protesters’ WhatsApp groups, represents a dangerous escalation of methods. Establishing a personal connection with unsuspecting citizens is a novel technique and is suspected to be merely the tip of the iceberg regarding methods of foreign intervention in Israeli democracy,” FakeReporter said in its earlier report.