Fog of War: Diverse Information Operations in Modern Warfare

so we're getting ready to invite our special closing speaker to the stage uh i have everything here with me actually so i'm gonna uh i'm just wanna share that this is a really special talk and it's worth the wait i'm so happy that we could have sanaz here share her story because she has such a unique perspective so i want to tell you a little bit about senaz yashar our closing speaker and i hope that she's getting the presentation and everything so please give me okay yes it's happening good so meanwhile i'll tell you a little bit about cenaz's background sanaz grew up in iran as a jewish person part of a jewish family and then

she moved with her family to israel so she became iranian israeli which is a complicated identity in of itself cenaz spent many years in the intelligence services and in 8200 serving israel and she has really special stories to share with us today from both perspectives of the intelligence field in fact she's going to talk to us about the fog of war and how state sponsored attackers are using not just cyber attacks but also psychology and information warfare to influence people so this is the place where information operations meet cyber operations and it meets all of us in our day to day lives it's something that we all actually have been exposed to it's what the new battlefield looks like

and i think she is almost ready and let's start by uh giving her a round of applause to make sure that she's got a good atmosphere good energy sanaa's made a very special effort to be here by the way i didn't tell you she also likes thai boxing so watch out she's a really really special lady senaz are you almost ready moments away what a fantastic closing speaker we have with you today please give it up for senator xiao wow whoa thank you so much for being here thank you so much please this is your spot this is your audience this is your stage thank you take this away thank you again and after this opening i

would say that maybe i would pass the brief because it's going to be down from here after you're open because you have the boots to kick ass all right so hello all i'm a little bit excited to see you all here it has been maybe two years that i haven't been seeing audience even it's not completely full but i was connected online to the site and i saw hundreds of people so why i'm here today and thank you for the opportunity besides accepting and myself i'm here to talk to you in a about something not very s like that you used to hear in these sites it's not that technical because i know that you're a crowd of hackers

um but it's not also something very you know spiritual and rochniky and that stuff so i'm here to talk to you in about something in between i'm going to tell you in the beginning i don't have all the answers but i have high a lot of questions here the reversal the reverser my reversal she just came in which is good i feel very confident when she's in the room um what we are talking what we are going to talk about is the fog of war and diverse information operation in modern warfare why i choose that uh why i chose that expression of war i i really hope that you would understand at the end of

this presentation and you know would be happy to hear you hear about it so what we are going to talk about is to be on the same page to talk a little bit about terminology and the spectrum of influence operation because everybody has a kind of other phrasing when it comes to influence operation then i talk about very briefly about why why we are seeing more and more stuff like that um we are going to dig in a little story to to set the ambiance and to get into the hardcore then real life examples from our own neighborhood but also from around the world which would include russia china and iran and maybe even more

we talk just a minute about the future or maybe about not that future i don't believe in you know prediction for the next year i think you can see maybe two months in the cyber world not that much and two months is also not very not very promised uh then uh we would talk about what can be done and so any question we have you can you know i think i can handle that you can just shout it out and we would get it terminology this is also a little bit new for me so when we talk about coordinated inauthentic behavior we talk about um accounts in social media but also others that are having a suspicious behavior and

kind of conducting a certain message not always with a content like retweets right or likes so this is more like a marketing like legit marketing world and then we have propaganda propaganda is not a very new expression there are years of years of propaganda there are people talking about in the bible it was talked but propangada is already intentionally conducting a certain message then we get to this information what is this information is conducting that message using what we call fake news so misinformation this information would be the closest to fake news and what is misinformation misinformation and sorry mom this is exactly my mom does because unintentionally she amplifies false information right she doesn't have

really bad intention but this is the period of people that actually continue to send that whatsapp message uh funny whatsapp messages it's the misinformation and there was a lot of misinformation also about kovit right so the question would be what is intentionally and what is the actor actually intended to message from here on and what is unintentionally amplifies like after shocks after the earthquake the next one is a graph we put together in pharah in the end um in order to a little bit simplify the this complicated word uh because when something is so much complicated for us and this is a problem that we actually see more and more when it comes to this information

we try to escape right and this one is a little bit to kind of show you that we have um misinformation and this information on the left side which is much more familiar to what we all know right um the actor when he already wants which goals he wants to achieve he has so many platforms and like 50 shades of this information that he can choose from and i tell you a secret most of the time he used more than one so getting to the left of this axis you can see more and more adopting and but just playing the the game right adapting to the social media and understanding how social media does and doing the right hashtag

and just be cool and tick-tock and all the etc getting to the right you can see it comes it becomes less and less legit and more and more cyber rrr right uh what does it mean that you try to post none um authentical news and messages intentionally sometimes you just you do it with the your account that you just put and there is a certain success you can achieve but sometimes you hack into the legit news site just imagine tomorrow morning you just wake up and you see a very disturbing title in i don't know why not it actually happens every day but it's our life right so um the the next after that we call it

doxing what means that you hack there is a whole cyber operation behind this operation that you hack to a certain environment you take all the secrets of the environment sometimes you manipulate them and sometimes you don't sometimes you manipulate just a little of them and then you release hack and leak what is the most famous event you know 2016 right the um elections for us the nc hack and hack and release and you already know that it was done by russians right and the last one i actually um added it just in the morning because i'm seeing it just during the the last months a month one month is that when you do that kind of a cyber warfare we

taught it's going to get done like cyber physical explosions the railways stop going planes are clashing but it's not just enough you convey the message to influence the opinion of public sometimes in the enemy space in farsi and sometimes in your space right in other languages so we have a combination here like we have all the goods all together at the last phase of this axis if it's going to develop more than that i think yes if i can imagine what's going to be next i prefer not so let's go further why they do that first easy asymmetric worm right sorry for the language but when the bar is asymmetric and then both sides or three sides they are not

capable of the same stuff when it comes to weapons so you answer to you win the technology by other means so the way you conduct a message the way you achieve the goals can be also conducted not by soft means right by uh publications i just said thanks to matan from my theme i just heard a nasrallah a brief i think three days ago um which was very surprising to me he says why he thinks they won the second lebanon war with israel and he says this is all because of the news and communication and media so everybody already knows that the media is has the power to change maybe the the real if there is a real right the real uh

effects of a certain um conflict the next i want to call it a zero day so there was days that the people comes to me with this information or fake information operation and i was said this is not cyber the cyber i know coming out from an elite unit yes is using zero days it's a non-click way of accessing your phone or your computer this is a zero day when it comes to the biggest vulnerability in society these are human minds right this is the most vulnerable part of the conflict in the time that you are you can be the best in the front lines right you have the best weapons and you have the best

airplanes and you have the best submarines you can get affected in the home front and this is exactly what they are trying to do i'm going to show you an example that the most strongest we get in the front lines and against our enemies um we are still very weak in our home front so this is the zero day we're using and the last one is that it actually oppose a capability for the actor for the operator for a plausible deniability because when it's good they can say maybe it's us it's ambiguous right so it would serve a kind of difference and when it's bad it wasn't me right i i i i remember the quote of putin

cyber hack us hacking like you know during the uh talks with biden so he has a very good sense of humor of course please don't take the light off um okay a little story very quick one this is back in december 2016 and i promise you this is the oldest evidence you're going to see do you know what is that anybody identify

back in december 2016 a ministry of defense of pakistan what is especially in pakistan there are nuclear country right there are nuclear power he tweets in a reply to an article was published in awd news to israeli ministry of defense that don't threaten me we are a nuclear country as well everybody like what is that first israel is not a nuclear company we don't have any nuclear we just have a you know textile factory maybe some textile factory second what is that tweet right apparently what happens that in a just in that article they actually quoted by mistake a tweet that was inauthentic to it a from israeli government that threatened pakistan that if you

send soldiers to syria so be aware i have no clear bomb very funny right but the tweet of the minister of defense of pakistan was actually real he was responding to that anyways thanks allah in this case or the god of cyber the ministry of defense of israel understand that something bad happened and very fast they actually react to the tree that it was all inauthentic and none of it this is true what we understand lately in fire right not lately later that year here yes but but my good side is my right side so all the photographers please go right thank you okay don't look at this eye okay um so later on back to the story

we attribute the whole network it's a large large network in many languages i saw it in arabic ho do hindu um i saw it in farsi and in english and we call it liberty front press and we attribute that network which is globally spread to a certain entity in iran you can call it cover company but it's a company that we call it international union of virtual media oh sas money said why it's why it matters after we do it facebook see our article and they understand that it's kind of whole fake thing and they go very fast and they remove 652 pages from facebook and some domains so you see okay that article was in 2000

the seizing of the pages was in 2018 okay so you say okay that's it complete admission completed that organization already gone this is i'm going back to the spot a this is a 2020 2020 the justice news the department of justice in u.s they actually publish that they seized 92 i believe right 92 uh different domains related to irgc i can tell you and there are maybe other um security companies in this room that they know that some of the domains they were seized they are still related to that organization 2016 2020 four years of operation not that much cost why they have to stop recent examples do you recognize this i'm hebrew is not my mother language as

a current told but even for me it's kind of weird even one of you tell me

how this is not my report my company's report this is a fake reporter kind of non-benefit organization i just found and they found it i like it because it's in hebrew a network of hebrew messages in in twitter that they are trying to use do you remember that right place of the access that they are trying to amplify and to saw uncertainty and fear in the israeli crowd during the shomer khomot what is really actually interesting the only thing is interesting and it's also because of matande told me israel under attack israel under attack was supposed to be good for us right this is the hashtag we used they used it to show fear who is going to be victim of this

messaging you no it's my mom again but when it's not that effective to people that are more understanding sometimes it's effective to people that are not very aware also another thing i want to tell you there is one thing that we can be very proud of us ourselves in israel i actually don't know how it happens but it happens we are not that sensitive when it comes to inauthentic information operation like as a nation we discover it fast i don't know how it happens maybe because we are a small country we all know each other we are very nosy we try to understand what is behind that name we are a nosy nation what to do so we

are even more immune than other countries i saw um this is the first but little by little we are seeing that it's going and actually getting more and more intense what does it mean but intense we are observing espionage actors like legit legit espionage actors um changing ttps and getting into more and more information operation sphere how they do that they actually hack news sites recently i saw a new site is not that big anymore they act they hack academy sites and ngos and think tanks and they post their own content sometimes they spoof email addresses like they have the whole phishing stuff they spoof emails and on the name of yourself of others i'm going to show an example

they would send an article to a certain news site in order to publish we saw them published and the last one i like because it's closed kind of the circles that information operation actually amplifies backward the cyber operation as well because that leaked data that inauthentic kind of documents used as lures to further fishing and what i told you the zero day is that there yes right right right okay maybe it means something but i'm always left ah okay thank you karen meanwhile in our neighborhood who knows that we have um this outed war with iran right so we said it's a cyber war they try to hack our water system but it's not just cyber war it's in

every platform it's in the sea it's in the air it's with drones right it's explosive you're hearing it all over but it's also in cyber this is actually one of the naughty ones i actually like before we are going to the second one we call it the impersonator campaign like terminator what not these two accounts you're seeing here which is maria livengood and she's a legit parliament member of u.s the right wait it depends on here the right one is the real one and the left one is the fake one um do you see any difference you're old enough to see there is no difference the content is the same everything is the same the only thing

that is different is the account itself right for months iranis iranian government impersonated real people in governments or in political groups they just got their own post and they post it again pictures of the children um everything they like they use she even talks about the receipt of the certain food i don't know something like that it's like everything and little by little they start to change a little bit the messaging right she started to talk about oh maybe she's not that happy with the recent israeli decisions about iran and maybe she thinks that we are israel is not referring to a palestine in a in a best way they can do but kind of very little i like it it's

like a cosmetic stuff it's not those information operations we saw like hungry children and and like anti-semitism and stuff this is like a art right they even change the picture that she looks angry or she looks happy with like deep fake so this what when we discovered it when uh she tried to send a letter to a certain news to be published that news actually checked the fact with us and we understand that there is a whole network behind it there is a whole network in many many languages i saw even they us there was also people in israel um i even remember one name that they were impersonated next one it's getting closer to what you all heard what was the

biggest news in last year december 2020 when we were all in one of the lockdowns i i stopped counting sheer bit stuff right a certain insurance company that is not now much more famous than it was before er got hacked and all the pii of all of a lot of our friends thousands of evidences was out they were claiming that they are cyber crime and they wanted money but they didn't get the money so they put it out are they cyber crime did they want money and they didn't get it so i can tell you now by sure that they are not cyber crime there is certain iranian group that we call them 2428. we know this group from

end of 2018. how we know that group because the investigation actually continued and we started to get some forensic evidence from that investigation in virustotal and other places and we saw that those hash hashes you can see and some of those infrastructure we already know them as a malware family we call saltibore this is a kind of pig i didn't know also and it's actually very capable malware and for years they are doing also in israel espionage activity very covered espionage activity so what happened that in december 2020 they started to hack and leak if it doesn't and a little later you heard also about kls another company got affected um also i want to tell you that

we saw also not just that a few linguistic evidences that we i i couldn't know at the beginning that it was like you know persian guys and not very educated try to talk like english to farsi and first into english you can see it here it's really funny um we are still on our world this is a team and this kind of world that you don't have any parallel to that in other languages so i can tell you that it's a way of this actor somebody have to chain me here okay just i'm going to be here and stay like this okay this is a way that this actor started from covered con kind of

stuff to do it much more of it there is always a possibility like a chinese or north korean kind of model that they did want the money right i can not completely say that it was from government and stuff but from certain information we know that they hacked other spaces we know they had much more information to leak than shear beats but they didn't leak that so raise that information they passed it to their commanders next one pay to key pay turkey or the recent variant networm unique homemade like a persian carpet ransomware this we attribute to a certain group we call it ankh 757 and 757 is a group actually active from 2016. in 2016 they

hacked as we know maybe they hacked more one certain entity in saudi arabia in 2017 they hacked entities in saudi arabia and a little bit more in u.s just in 2020 they started to look at israel as well the whole hacking and the whole operation was espionage operation a very aggressive way of getting in we call it smash and grab and take it out right in i remember one of their hacks in in 4th of july but in australia i think they didn't know that 4th of july is just in u.s that in 12 hours the terabytes of data was exfiltrated out in the night right um so they started to to appear here we

know a lot of victims or potential victims but we saw them for the first time that their initial access was uh from amital this is a third party that had access to other stuff they started to doxing high-profile targets and if it's not enough they also really wanted to look like cyber crime right and they have this twitter trolling like other ransomware accounts and they have this nice like the only thing they they don't have here is like a skeleton right in the ransom note is it espionage is it cyber crime or is it for influencing the home front of israel during that cyber war that was outed we can discuss here or other but there

was a certain moment i remember that i understood but maybe i'm mistaken that it is it has to do with influence operation we try to engage one of the actors related to this actor this actor also known as a fox kitten i believe by other security vendors um we engage one of the actors and we try to see what we can buy from him and he was very certain that he's not going to sell us anything that is opposed to iran interest good hacker no anyway let's move on we are getting closer to the end a russia russia information operation is not just something new that they just invented they are the whole thing behind it like we all have

to learn from russia it's in doctor line of russia for years um i'm not that good in history so but for years you can see russia conducting information operations with media and non-cyber one in the news and everything but i wanna mention one campaign that i'm actually amazed by we call it ghostwriter ghostwriter is a campaign not related to our neighborhood so it's much more fun to talk about others problem unlike the uh the two before it's uh targeting a polling poland um and other eastern europe country ukraine poland um i think it's also belarus and other countries there which and it has like anti-nato messaging and they use several spoofed emails and accounts and they hack to the sites and

they um publish actually news that it's not right um look at this one they actually compromised into the government of poland to for officials you know if the government of russia have access to government of poland i would say that is the you know the end of the game but not they would use that access in order to publish on behalf of that officials on behalf of the officials more and more messaging like they even have a very nice sense of humor like they are publishing nothing that is related to russia they are trying to get them like fight together like poland interfering belarus um which i don't know when it's going to be end it's years of

conducting uh things the last one i saw just i think in may this year look at this one here they hacked to university they published on behalf of university something and here which is very cool we could finally just in 2021 um attribute or part of this group operation especially when it comes to infrastructure to a certain a hacking group that is related to russia that we call it aung 1511 and 1511 is already a group that has certain malwares that have a very special attack life cycle they have a way to get in they have at least three family malware's that we call them you can see radio star and half shell they are using but they also

do those hacking and then give it to ghostwriter and then go straighter does what they does we do believe that this actor is related to gru

here's the moment that we can see that if you are still safe about gru there are at least two actors that you should know about right this is the sandworm team that on one side they are been really taking off electricity and doing not prettier stuff and then the other thing like as a brick they do defensemen on approximately 100 websites in georgia with that picture this is the former president of georgia what they are trying to achieve who is the audience how they are going to measure themselves if they were successful or not how they are getting more budget for the next year i still don't know how it went because and apt 28 i'm not going to talk about

it that much they are the most responsible one for the dnc democratic uh um a group hack in us china i think china is very different when it comes to information operation um i chose to bring one example this is the example i'm actually exposing for the first time we haven't talked about it and probably we are going to talk about it more next week so stay tuned for the blog um first we see a lot of chinese groups that are targeting media this is the amount of chinese group you can see on the right that are targeting in a portion media why they target media because they are the big brother they have to

understand what they are going to publish but they also want access in order to publish themselves stuff we actually have a blog on that breaking the news operation target media so i invite you to read about it the next one i'm going to talk is a certain actor that is active in our neighborhood which is a kind of evolution of what we call apt-27 apd 27 uses a certain malware family that we call focus fjord i know it sounds like swiss but in chinese focus sphere focus field is a certain malware very complicated it's actually a first stage but it has also second and third stages that when it gets to your environment it looks for the

um most important servers and then it install itself in the hard disk and then it delete is the c to other components from the hard disk and it actually um encrypt it in a registry this is the registry key on the left you can see the value on the right you can see what actually means right so most of the variants we were looking at thank you staff is a actually one two three right one is the executable and as you can see eight is c2 like we understand after reversing it this is why it hangs off because she reversed it we understand what stand these numbers stand for on the right you can see the same malware the same

registry values in farsi deracht dal host

like what does it mean it's not even close to the name or to the what the value actually means by why is it why it is in farsi why not why not because they could do one two three we see a lot of stuff false flag rare where used they used farsi in israel they used farsi first flag in first in israel also in uzbekistan you can see more variants of the same factor english farsi hindi

this misinformation this information is embedded in the code does it mean this is the only value in their marvel that is not encrypted because we heard so many curse from yuri and estovia reversing the vulva because it's hard to reverse it but then we have these values that are not encrypted so imagine that they got caught or something not really okay you get to do forensic there are people to forensic i'm not a forensic lady and you don't get that the first thing you can see is the values even if you put it in the sandbox this i know to do without the thing you can see the values in farsi and in hindi what do you think

iranians again what's new iranians hitting our critical infrastructure what's new we are in a lot of contracts with china and business and economic relations so it's just a kind of safe way to blame or try to blame iran but what is funny i'm just going back last time to the far sitting that far see the farsi speakers in the room how many are there here just one thing throughout ah here's another one that force is a dictionary farsi is not a farsi that hackers use just imagine a hacker talk in a very polite way right

i showed you the ang-757 with the pay-to-key stuff full of persian curse even the handles uh in darkware darknet there were so many bad words in farsi that actually felt like embarrassed to investigate that to investigate that and here you can see oh nice for us this is my father's parsy okay uh so you can see they tried it's not very sophisticated but it would show the immediate suspect right as i run embedded in the code what now what is this

do you know what is this nobody saw that the yes right it's something about ministry ministry of transportation in iran the date that i did a very nice yellow line i'm very famous with my not direct yellow lines down there says a july 10 2021 this is from july 10 2025 and it says dear minister of transportation in iran your computer's systems and also the computer system of railway company are under cyber attack this is our message for the responsibles payatandra has gillimetan de la starnac on it now i have to find a way to translate it this is a phrase pizzgam right in farsi that there is just in fuzzy and it means don't

get more comfortable that you are don't take your foot out of your carpet just stay where you are don't get out everything in farsi is related to some carpet um what is this have you heard about railway in iran stopped yes you heard who is the audience who is the actor i don't know what he's going to achieve this is the future of cyber hacks information is it effective probably yes there are a lot of propaganda now in iran and strikes in just a second now what i showed you a lot of examples somewhere very kind of into ethic he could see like it everywhere like everybody's talking about it and some were embedded in the

code and some were embedded in somebody's computer they are everywhere this is a fog of war this is a war or this is our life if it's everywhere it's already war this is going to be our life we are not a lot of this information and information operation also about covet right this is everywhere so if it's that usual we are still going to use it the terminology as a warfare or something else i don't have the answer i know that i think there are red lines like everything in the world if there is a red line i'm not bb with the you know the red line to show you where is that red line

where is that lead time so i do believe also that even if you want to stop it i showed you like lots of seizing domains and closing accounts and you know no no no stuff the day after they are going to do it again what is the real cost you can take from the operators but maybe also it's a kind of clean kind of war i like it right no soldiers get hurt what can be done so for the good people that in between like my mom right that i don't want them to get affected by by uh fake news i would say there would be maybe three best practices i saw during the last

year the first communication you win information operation by bringing the right information to the right people on the right media at the right time don't hide stuff just talk about it right we are we saw a very actually successful i believe campaign in usd us during the last the last elections four generals from four organizations all together talking to the crowd in the tv right no hacking everything is safe don't worry there is no fake news or there was the proud boys there was like um iranian group tried to do misinformation calling people in u.s if you go vote for trump we are going to beat you people actually was afraid they're going out to the news and saying

ah they can do nothing to you this is fake communication communication communication [Music] ladies are better than men in this world i'm sorry to tell that so i really believe that we have to enhance communication around it the second one i just heard that biden was a blaming facebook right about why the vaccination was not as successful that he wanted because there was a lot of misinformation posted by facebook accounts did you heard have you heard about it i was like by then he's the president of the biggest democratic company i know he is talking to facebook okay what does it mean that facebook has the power now at least like the president of u.s

so there is responsibility has to be taken by these platforms they are doing a lot of good to the world bringing us technology and bringing us communication everywhere and we are not you know in dependent to one or two channels but they still have the responsibility to check the facts and to continuously look for inauthentic behavior the last one is education i heard i don't know for sure that it's right that i heard in finland from the second or the third grade they learned in the school primary school to ask questions about information they see in internet i don't know if it's right i prefer to imagine that is right and i think it's going to correct itself

because i have two boys nine and six and they are much more aware than me when it comes to internet information they look at something ah it's not sometimes they're looking at really serious stuff in the news because i'm seeing news when they are still awake and ah it's a fake right mom yes fake fake don't believe everything you see so i believe that it's going to kind of correct itself and people because they are living in this room in this world that is many challenge the channels and platforms of information they would have to learn how to conduct and how to decide which information is right and which is not us being mostly analysts this is what

they teach us right in the units how to triage data i do believe that this has to be common knowledge question everything why thank you [Applause] i want to give you this on this is a beautiful flowers for a beautiful and most importantly brilliant right brilliant right side inside thank you and brilliant and such a unique perspective now it is a besides tradition let's stay here it's okay okay throw it on the floor let's stay here okay so it's a besides tradition that the first time juice whiskey or water of course whiskey i came very good very good a girl like me so it's a besides tradition that the first time besides speaker gets to have a chaser

with us on stage and she did a fantastic job thank you how do you say like i'm in farsi no no shenzhen and this is what's going to send us off to an amazing after party thank you sanaas thank you so much for joining us that's it from us everybody this was our party i hope i stayed quiet i'll see you out there at the party and for those online i'll see you next time till then sayonara we love you thank you so much everyone i'll see you outside