Iran’s Supreme Leader Ayatollah Ali Khamenei delivers a televised speech in Tehran, Iran. Official Khamenei Website/Handout via REUTERS

Microsoft’s Threat Analysis Center on Tuesday released its analysis of Iran’s growing cyber operations, revealing that nearly a quarter of Iran’s illicit hacking activities were directed against Israel.

“These operations remain focused on Israel, prominent Iranian opposition figures and groups, and Tehran’s Gulf state adversaries,” the report said. “The goals of its cyber-enabled [influence operations] have included seeking to bolster Palestinian resistance, fomenting unrest in Bahrain, and countering the ongoing normalization of Arab-Israeli ties, with a particular focus on sowing panic and fear among Israeli citizens.”

The United States, the United Arab Emirates, and Saudi Arabia were among the other countries most frequently targeted by Iran.

Microsoft also concluded that an Iranian state actor was likely involved in the planning of the 23 Nov. bus bombings in Jerusalem that killed a 16-year-old Canadian yeshiva student, a conclusion that they reached based on the hacking group releasing CCTV footage of the attack.

“The group’s access to and release of the sensitive footage on the same day as the attacks suggests involvement in the planning of the attack on civilians, even though the Iranians may not have been responsible for the bombing itself,” they said.

Many of Iran’s efforts now combine a traditional cyber attack like defacing a company’s webpage or stealing user data with a influence component designed to spread fear or exaggerate their prowess, for example by sending out mass SMS text messages or amplifying the operation on social media.

In December, one Iranian hacking group impersonated Sport 5, an Israeli sports channel, and sent thousands of SMS messages to Israelis warning them not to travel to Muslim countries.

“If you like your life, do not travel to our countries,” the message read.

While Microsoft notes that Iran is “rapidly accelerating” these cyber influence operations, there has also been a corresponding decline in ransomware and wiper attacks that had previously been a prime Iranian cyber tactic.

Microsoft claims that most of the operations are conducted by the group Emmenet Pasargad, part of Iran’s Islamic Revolutionary Guard Corps, which was sanctioned by the US Treasury Department in 2021 for attempting to influence the 2020 US Presidential election.