Emerald Divide Uses GenAI to Exploit Social, Political Divisions in Israel Using Disinformation – Source: securityboulevard.com

An advanced persistent threat (APT) group backed by Iran has been stoking divisions within Israeli society for the past three years. It has been using generative AI deepfake tools and social media accounts to craft disinformation campaigns.

According to research from Recorded Future’s Insikt Group, the group, known as Emerald Divide (Storm-1364), has been active since 2021. It has exploited divisions between religious groups and the LGBTQ+ community, left and right political flanks, and capitalized on the ongoing war between Israel and Hamas.

Emerald Divide is also conducting “doxing” operations on Israeli officials, publicly broadcasting personally identifiable information (PII) about them, all to intensify social and political polarization within Israel.

The 30-page Inskit Group report noted that the group’s tactics constantly evolve, in an effort to further drive audience reach and engagement as it expands its disinformation infrastructure beyond the existing 16 social media accounts. The report documents a YouTube channel hosting deepfake videos of Israeli Rabbi Shlomo Moshe Amar, which remains operational at the time of writing.

“The observed increase in advanced influence threat actors adopting and implementing AI will likely continue to improve over time with advances in technology and repetition of operational employment, likely increasing the overall effectiveness of influence operations to achieve behavioral change in line with a specific objective,” the report cautioned.

GenAI Boosts Content Creation Capacity

Sean Minor, Senior Threat Intelligence Analyst at Recorded Future’s Insikt Group, said generative AI is enabling threat actors to produce content rapidly and at a large scale with increasing quality that is capable of deceiving viewers.

“This ability to rapidly produce content increases the difficulty of detection and mitigation based on the ability for a threat actor to deliver such content to a target audience before social media companies or researchers can intervene,” Minor said.

Based on the campaign’s historically observed activity, Minor said, it is likely the campaign will change its influence objectives again based on emerging targets of opportunity that trigger competing reactions from various political factions within Israel’s government and its broader political system.

This could include events such as Israel’s next legislative election, which is scheduled to take place in October 2026.

Public awareness of this campaign and its corresponding infrastructure will likely reduce the risk of unwitting online users engaging with and subsequently being influenced by the network. “Increased awareness can be achieved by engaging the public, in this case Israeli citizens, about Emerald Divide through various communication vectors such as government, media, private companies, as well as leaders and influencers in the public and private sectors,” Minor said.

AI Used as Countermeasure

Patrick Harr, CEO of SlashNext, explained that new AI tools could be deployed to counter misinformation and disinformation campaigns like Emerald Divide. These tools can determine the source, type and techniques used in campaigns or attacks. They can be deployed by service providers and companies alike to detect and remove campaigns before they achieve their stated goal: social unrest, division and disruption.

“It is critical for service providers and companies to deploy AI-based anti-phishing and anti-social engineering digital protection tools in both email and collaboration and messaging platforms,” Harr said.

This is critical to eliminating the next step in disinformation campaigns. Yes, they disrupt and distract. But they also get their targeted victims to give up passwords or personal information ot to participate in scams.

“For example, a disinformation campaign could also be tied to, or followed up by, a fraudulent request to donate funds to a fake charity claiming to go towards supporting victims and their families,” Harr said.

Collaboration among government, technology companies, and security research organizations to track, monitor, and disrupt this influence network and its associated threat actors will likely reduce the campaign’s effectiveness in its current form, Minor added. “Security teams can utilize threat intelligence capabilities to monitor their digital assets in real-time, enabling a timely response to neutralize any negative impact counterfeit online content may have on the organization—ideally before such content has time to persist and cause harm,” he said.

Photo credit: Jametlene Reskp on Unsplash