ISD Global is reporting that Iran's information warfare tactics have evolved significantly, moving beyond traditional deception to embrace new, highly adaptive forms of hybrid warfare. It said Tehran has long engaged in aggressive cyber and information warfare, but new tactics include popular AI-generated parody videos and "violence-as-a-service" recruitment models.
ISD Global said Iran's informational approach during the ongoing conflict has challenged existing paradigms for countering foreign malign influence. After initial postings of AI-generated manipulations and falsehoods, Iranian government and pro-regime influence campaigns have found success by entertaining audiences rather than solely deceiving them. It said this includes LEGO-styled rap videos and AI-generated parodies, which soften Iran's global image and effectively neutralize traditional responses. ISD Senior Research Manager Peter Benzoni wrote in Foreign Policy that this results in "incredibly effective propaganda that our entire toolkit was designed to miss." ISD's analysis of Iranian diplomatic accounts showed a 30-fold increase in likes on X (formerly Twitter) during the first 50 days of the conflict compared to the prior 50 days.
Pro-Iranian activity has also included darker elements, notably implicit and explicit antisemitism. ISD's investigation into two pro-regime account networks, dubbed BRICS4CLICKS and Verified4War, found both praised Nazi Germany and Adolf Hitler while promoting antisemitic conspiracy theories, gaining over a billion views in the conflict's first month. A separate ISD analysis found antisemitic posts increased by nearly 70 percent in the week after the conflict began, with a spike in user-to-user antisemitic hate speech and conspiracy theories about "Jewish elites" orchestrating the conflict.
The conflict has also triggered offline attacks on Jewish communities in the United Kingdom and Europe. Eighteen of these attacks have been attributed to a new group, Harakat Ashab al-Yamin al-Islamiyah (HAYI), analyzed by ISD and linked to Iranian-backed proxy militias. The group is allegedly the creation of Muhammad Baqer al-Saadi, a high-ranking member of Katai'b Hezbollah, an Iranian Revolutionary Guard Corps-backed Iraqi militia. Al-Saadi, who was arrested and transferred to American custody, was close to IRGC leadership, including the late Qassem Soleimani. ISD Global said al-Saadi used accounts on Telegram, Snapchat, X and Facebook to promote attacks on American and Israeli interests, calling to "kill everyone who supports America and Israel." The U.S. Department of Justice alleges al-Saadi planned, executed and promoted attacks in Europe and called for the death of U.S. President Donald Trump and his family.
ISD analysts describe al-Saadi's strategy as "violence-as-a-service," relying on financially motivated individuals, often young people or minors, recruited through encrypted messaging platforms. This operational structure, using disposable proxies, makes it difficult to track. ISD Global said this attack architecture mirrors Russian hybrid tactics. It concluded that the convergence of state-directed violence, criminal infrastructure and antisemitic targeting into a single operational model represents a turning point, requiring enhanced awareness and coordination between government, law enforcement and social media platforms, along with a comprehensive strategy for hybrid deterrence.