Shin Bet exposes Iranian cyber espionage targeting Israeli hostage families

Shin Bet exposes several online platforms allegedly operated by Iranian security agents.

Families of Israelis held hostage by Hamas terrorists in Gaza hold up photographs of their abducted family members, outside the Egyptian embassy in Tel Aviv, October 26, 2023. (photo credit: TOMER NEUBERG/FLASH90)
Families of Israelis held hostage by Hamas terrorists in Gaza hold up photographs of their abducted family members, outside the Egyptian embassy in Tel Aviv, October 26, 2023.
(photo credit: TOMER NEUBERG/FLASH90)

Iran is using fake online profiles to gather intelligence in Israel, the Shin Bet (Israel Security Agency) reported Monday.

Among its tactics are operations to photograph the homes of security personnel and public figures who oppose Iran in the media, it said. Public demonstrations for the hostages’ return are used as a platform to photograph participants, it added.

Iranian operatives are also targeting the families of hostages via fake expressions of grief, such as sending bouquets and messages to the families’ homes, the Shin Bet said. Other means of intelligence-gathering include fake survey prompts and volunteer forms that are used to gather information about personal details and skill sets, it said.

According to the Shin Bet, Iranian intelligence has used these online platforms to gather information:

Tears of the War spreads “disinformation and incitement” and is presented as a tool to recruit Israelis for activism on behalf of hostages, along with fake job postings.

Here+ poses as a research and survey platform, using a logo that appears to be based on that of Israel’s Channel 11. The platform is believed to use phishing to collect personal details of Israelis.

 A smartphone with a displayed Iranian flag with the word ''Cyberattack'' and binary codes over it is placed on a computer motherboard in this illustration taken February 23, 2023. (credit: DADO RUVIC/REUTERS)
A smartphone with a displayed Iranian flag with the word ''Cyberattack'' and binary codes over it is placed on a computer motherboard in this illustration taken February 23, 2023. (credit: DADO RUVIC/REUTERS)

BringHomeNow is active mostly on Telegram, posing as a movement for the return of the hostages, using false volunteer forms to collect Israelis’ personal information.

Several other fake platforms purport to align with different political movements and are designed to deepen divides in Israeli society, the Shin Bet said.

Israeli organization 'Fake Reporter' responds

FakeReporter is an Israeli watchdog organization that exposes false reporting, bots, and similar activities online. Since the start of the war with Hamas, the organization claims to have exposed several foreign influence networks that attempt to employ Israelis, with violence at the center of their goal.

In response to the Shin Bet report, FakeReporter said: “We have been warning for a long time that the online ‘borders’ have been breached. These latest reports prove that the ‘fences’ have been breached on the Internet for a long time and that the enemies have settled among us.”

The state is “not doing enough to protect the public within virtual borders,” it said.

FakeReporter also called for a national plan for online safety that would allow Israelis to report online attacks in a similar way to how they report in-person attacks.