For numerous years, the relations between Israel and Russia underwent fluctuations akin to a rollercoaster ride. However, in the past decade, it appeared that the historically tumultuous relationship had found stability, with the two nations cultivating warm and close ties. This perception was largely shaped by the consistent efforts of Prime Minister Benjamin Netanyahu, who sought to present himself as a close ally of Russian President Vladimir Putin. Netanyahu made multiple visits to Moscow, hosted Putin in Israel, and prominently featured their amicable interactions in his 2019 election campaign. Billboards across Israel showcased images of Netanyahu and Putin shaking hands, asserting that the Israeli prime minister was "In a different league" compared to his political rivals.

The Russian invasion of Ukraine sent shockwaves through bilateral Russo-Israeli relations. Russia was unhappy with the Israeli response to the war – even though that response was tepid, at best – and, more importantly, it found allies and arms dealers in Tehran and altered its Middle East policy accordingly. Notwithstanding his alleged “friendship” with Putin, even the return of Netanyahu to power in early 2023 did not change the equation.

If anyone was still laboring under any misapprehensions about relations between Jerusalem and Moscow, the October 7 massacre and the war in Gaza surely dispelled any doubts. Russia did not even bother to hide its pro-Hamas position and worked against Israeli interests on the diplomatic stage. In early December, a new nadir in bilateral relations was reached, when the Prime Minister's Office reported on a tense telephone conversation between the two leaders, during which Netanyahu was highly critical of the Kremlin’s policies.

A new investigation by Shomrim now reveals that Russia’s anti-Israel activity was not limited to declarations and diplomacy. Since October 7, groups with direct links to the Kremlin have been operating against Israel on various online platforms. They have launched cyberattacks and disinformation campaigns against Israeli and international uses of these platforms. The damage, it is important to stress, is not huge and some of these attacks are rather bizarre – but they are still a fundamental issue which is part and parcel of Russia’s decision to act against Israeli interests.

Ties with Iran alone cannot explain Russian interests in these attacks. Jakub Kalenský, from the European Centre of Excellence for Countering Hybrid Threats, is an expert in disinformation. He says that they are part of Russia’s general strategy for undermining the West, in part by using disinformation. “Against the backdrop of the West’s support for Israel [Western governments – M.C.], Russia saw an opportunity: It believes that bolstering anti-Israel sentiment across the world will also lead to anti-Western feelings and Russian empowerment.”

Shomrim asked the Russian government for its response to this article but did not receive a reply.

The first attack launched by these groups came just two hours after the start of the Hamas attack on that fateful Saturday morning and was directed against Code Red and Siren – two Israeli applications that provide alerts regarding missiles fired at Israel and instruct residents to enter protected spaces.

The Disinformation Campaign: Fake News and Fake Websites

Russia’s use of fake news and disinformation is nothing new – it has employed both tactics in its interactions with its main rivals on the international stages, as well as with Israel. Known as Doppelganger operations, these campaigns have been used by Russia at least since the invasion of Ukraine. In June, for example, French authorities uncovered almost exact replicas of several Israeli websites that were used to spread disinformation. Russia’s fingerprints were almost immediately identifiable, given that both of the Israeli websites published articles arguing that Jerusalem’s support of Ukraine was harming the economy and security of Israel.

Shortly after the October 7 massacre, a new anti-Israel disinformation campaign began to spread online. This campaign was unprecedented in its scope. The campaign was based on forged articles that were then published on websites designed to look exactly like legitimate Israeli and international news outlets. A fake version of the Walla website, for example, warned that Israel is losing the information war. At the same time, another claimed that “leftists” were planning to solve the economic crisis created by the way by giving “money to Arabs” and leaving “the Jews in poverty.” Another fake website claimed that the United States could no longer afford to continue funding various regional conflicts and would soon have to choose between Israel and Ukraine.

In early December, another fake article on another fake website – this time Israeli magazine The Liberal – tried to create domestic tensions over the negotiations for the release of Israeli hostages by describing the dialogue with the terrorist organization as “a hopeless trap.” Another fake article on the same website, allegedly quoting the Bloomberg news agency, argued that “the United States is betraying both Israel and Ukraine.”

Those responsible for disseminating fake news did not stop with Israeli websites and also created fake versions of several international news outlets, through which they tried to stir up antisemitic and anti-Israel sentiment. A fake version of the Le Parisien website, for example, published an article attacking President Emanuel Macron and alleging that he has “the blood of Palestinian children on his hands.” A fake article claiming to be from the German newspaper Der Speigel presented an entirely false report from the Gaza Strip, while an article on a Fox News forgery dealt with the United States’ need to choose between Israel and Ukraine. The list goes on.

At the same time as the Doppelganger operations, there was also a concerted campaign of disinformation and psychological warfare taking place on social media platforms. For example, the accounts on various platforms artificially amplified fabricated photographs of antisemitic graffiti that were allegedly taken in Paris and a fake video purporting to be from German television network Deutsche Welle, showing Jewish survivors of the Auschwitz concentration camp apologizing to Palestinians for the IDF’s action in the Gaza Strip. Another widely shared video suggested that there could be a repeat of the 1972 massacre of Israeli athletes at the Munich Olympics when the Games are hosted in Paris next year.

The fake articles, the posts and the videos were shared on social media platforms, especially Twitter (now known as X). The eight fake articles from Walla and Liberal, for example, were shared online by several thousand different accounts.

Another indication of the extent to which fake news is being spread comes from the head of @antibot4navalny, a group of anonymous Russian experts that tracks Russian disinformation and is considered a reliable source of information.

On the night between November 20 and 21 alone, according to the head of @antibot4navalny – who, naturally, does not want to be identified – more than 2,000 Twitter accounts posted almost 3,000 links to disinformation articles on fake copies of the Walla and Liberal websites. According to the group, these tweets were part of a widespread disinformation campaign that covered a variety of issues, not all of which were related to Israel’s war in the Gaza Strip.

At the height of the campaign, the group says, around 12,500 Twitter accounts shared 27,000 posts at a rate of 120 posts per minute.

On the night between November 20 and 21 alone, more than 2,000 Twitter accounts posted almost 3,000 links to disinformation articles. At the height of the campaign around 12,500 Twitter accounts shared 27,000 posts at a rate of 120 posts per minute.

Russian Links and Fingerprints

The internet is full of anonymous fakes and it is almost impossible to find out who created them. In the above mentioned cases, the link to Russia comes from governments and from a technological analysis of the campaigns. The first time Russia was linked to these campaigns was over the summer, when the French government claimed that the above mentioned campaign was carried out by “state-affiliated bodies identified with Russia, which participated by spreading false information.”

The European Union also weighed in on the issue, saying that Russian authorities conducted their disinformation campaign through two companies which purportedly deal in advertising and distribution: Structura National Technologies and Social Design Agency. They do so by creating “fake websites impersonating government organizations and legitimate media in Europe (primarily Germany, France, Italy, Ukraine and the United Kingdom).” An analysis of the websites of these two countries reveals that they both promote a blatantly pro-Russian line, especially in the context of the war in Ukraine.

According to technology experts, the Doppelganger campaign against Israel is a direct continuation of the campaign from the summer. The basic strategy, the tools used, the way new accounts are opened on the social media platforms used to spread the disinformation and many other elements are identical and provide a clear fingerprint of who is behind these fakes.

Apart from these findings, members of the @antibot4navalny group also found that some of the accounts that had participated in the Doppelganger campaign against Israel were now sharing a propaganda video praising Putin. The video was accompanied by tweets in French, Ukrainian, English and German. Given the extent to which the Kremlin exerts control over various bodies and organizations operating in Russia, the importance that the regime attaches to Putin’s image and the scope of the multilingual campaign, the head of @antibot4navalny is convinced that those responsible for the Doppelganger campaign are operating with the direct approval of the regime.

Prof. Karine Nahon, head of the Data, Government and Democracy program at Reichman University, says that Israel is especially exposed to the spread of disinformation and propaganda based on fake news. According to her, “fake news tends to be a lot more viral during times of war, elections and disasters. Israel is going through a hugely vulnerable period. For Russia, unfortunately, this is indeed an opportunity.”

The war against Hamas in Gaza, she adds, broke out after almost a year of political turmoil and social division over the Netanyahu government’s planned reform of the judicial system. Internal disagreements, she explains, increase the potential influence of disinformation campaigns and the dissemination of fake news aimed at intensifying the divisions even more.

Kalenský adds that the Israeli-Palestinian conflict is particularly attractive to Russia in the context of disinformation for two main reasons: the international community is interested in it and it manages to elicit strong emotional responses from readers – the exact opposite of a logical and rational discourse. “Russia is trying to take advantage of this international attention for its own purpose, by inflaming anti-Israeli emotions. Apart from this, I believe that they would be more than happy for some of the global attention to move away from the war in Ukraine to what is happening in Israel.”

Ties with Iran alone cannot explain Russian interests in these attacks. Jakub Kalenský, from the European Centre of Excellence for Countering Hybrid Threats, says that they are part of Russia’s general strategy for undermining the West, in part by using disinformation.

Cyberattacks: Code Red App Collapsed

In addition to disinformation campaigns, Israel was also the main target for two hacker groups – Anonymous Sudan, which has no connection to the country, and Killnet. Both of these groups have attacked Israeli websites in the past, but in the aftermath of October 7, the number of attacks they launched against Israeli targets skyrocketed.

The first attack launched by these groups came just two hours after the start of the Hamas attack on that fateful Saturday morning and was directed against Code Red and Siren – two Israeli applications that provide alerts regarding missiles fired at Israel and instruct residents to enter protected spaces. Anonymous Sudan claimed responsibility for the attack, claiming – without providing any proof – that it had managed to disrupt the apps’ functioning. Two weeks later, the same group revealed that it had attacked the apps again, this time providing a screenshot from a web monitoring service confirming that the applications were unavailable at the time in question.

It is important to stress in this context that the goal of these attacks is to sow panic among Israelis concerned that the much-vaunted missile alert system does not work, but it is highly doubtful whether it achieved its goals or whether the average Israeli was even aware of the attacks. Shmuel Gihon, a cyber security analyst from CyberInt, confirms this, adding that “it is highly doubtful that these groups managed to create any panic, but they did disrupt the applications.”

Among the other targets selected by Anonymous Sudan and Killnet were Israeli news websites. They managed, for example, to block access to the Jerusalem Post website, a valuable source of information about Israel for many people in the Jewish Diaspora, for more than three hours. They also briefly took down the Israel Hayom website, as well as blocking access to the website of the Associated Press news agency, which it accused of having a pro-Israel bias.

There was also a series of attacks on Israeli websites which provide citizens access to government services, as well as the website of the Shin Bet, several Israeli banks, HMOs and others. Anonymous Sudan and Killnet claim that their attacks brought down these websites and provided confirmation of this from the CheckHost web monitoring service. It should be pointed out that, as far as we are aware, no information was stolen from any of these websites and the sum total of the damage was that traffic to them was blocked from anywhere between a few minutes to a few hours.

Its name notwithstanding, Anonymous Sudan has nothing to do with the African country. Rather, its footprints lead directly to Russia. As far as can be ascertained, the group was established early in 2023 and quickly became the most recognized and important group in the hacking world. Gihon explains that the group gets its strength from external supporters, who fund the expensive infrastructure it needs to operate on such a massive scale. “This group came from nowhere,” he says, “and within two months, it built a robust infrastructure that would allow it to attack organizations and even other countries.”

Either way, shortly after its establishment, Anonymous Sudan announced that it was becoming an “official member” of Killnet, a pro-Russian cyber network known for its attacks on Western targets. The “alliance” between the group and Killnet – along with its impressive capabilities – led several cybersecurity experts to believe that the group is part of an organized operation which could be connected to state players inside Russia.

According to various reports, Killnet has worked with the GRU – Russia’s military intelligence agency – to launch a cyberattack against Ukraine just hours before the Russian invasion. Cybersecurity officials in the United States, Australia, Canada, New Zealand, and the United Kingdom have included Killnet on their lists of criminal cyber threats “sponsored by the Russian state.”