On-Isnad Activity
Welcome to Memetic Warfare. We’re continuing an unusually productive week with a special guest post from my friend and colleague Max Lesser below looking at an influence operation targeting Israel.
As always, Memetic Warfare guest posts are the sole opinion of their author.
ISNAD that Deep: Persistent Islamist Influence Campaign Targeting Israel Adapts to Iran War
My name is Max Lesser. I work with Ari at the Foundation for Defense of Democracies (FDD). I am sharing research that I conducted in collaboration with my colleague Emmerson Overell and my interns Kellie McSween and Ethan Scheinker.
On March 10, Emma and I published a high-level overview of our findings on over 100 accounts on X that we linked to ISNAD, a persistent Islamist influence campaign that impersonates Israelis with the express intention of destabilizing Israeli society. An Egyptian expat with historical ties to the Muslim brotherhood orchestrates the operation, which crowdsources its participants. The expat, alongside a central management team, reportedly coordinates the participants via Telegram.
We identified 118 accounts that appear to impersonate Israelis, post coordinated paraphrased content, and amplify divisive narratives, including the following: the Israeli Prime Minister is evil; the Israeli government is an undemocratic regime; Israel’s leaders use war to distract the public and preserve power; and internal ‘enemies’—including Haredim, settlers, and the Israeli government—pose a bigger threat to Israel than Hamas or Iran. These tactics, techniques, and procedures (TTPs) and narratives align with reporting on historical ISNAD activity by researchers at Active Info, the HarediLine, the Institute for National Security Studies (INSS), and Fake Reporter, among others.
After the U.S.-Israel war with Iran began on February 28, the network began increasingly incorporating Iran-related narratives, which increased from 3% of the network’s total content before the war to over 20% of its content afterwards.
Impersonating Israelis
Between March 2nd and 9th, all 118 accounts in the network appeared to impersonate Israelis by posting Hebrew-language content speaking from the perspective of Israelis, and sometimes also by explicitly listing their location as Israel. 2 of these accounts, however, were no longer active as of March 30, 2026, i.e., @raphael95yair and @Poorbaby0.
X’s transparency features show that 57 of the accounts had metadata indicating a location outside Israel in either X’s ‘Account Based In’ or ‘Connected Via’ fields. X states that the country or region displayed under ‘About this Account’ is inferred from aggregated IP addresses. X’s ‘Connected Via’ field shows how an account’s user connected to X, which is often via an app store in a specific country or region. Regional app stores associated with this network spanned West Asia, North Africa, Europe, and East Asia, while country-based app stores included Egypt, Morocco, Germany, Iraq, Cyprus, Algeria, Tunisia, Italy, the UAE, and Côte d’Ivoire. Additionally, 68 accounts were marked as based in Israel in the ‘Account Based In’ transparency field. However, X flagged all 68 of these accounts for possible VPN use.
The location metadata described here is based upon observations made between March 2nd and 9th, and may not reflect the current location metadata. Location metadata can change over time when accounts connect in different regions or via different regional proxies, and this metadata can also be spoofed.
Figure: Images of four accounts in the network presenting themselves as Israelis
Figure : X’s transparency feature showing the same four accounts connecting via Android apps associated with Iraq, Morocco, and North Africa.
Coordinated Posting
The incongruity between many of the accounts’ Israeli presentation and their location metadata is a strong indicator of inauthenticity. The network’s posting behavior demonstrates that it is not only inauthentic, but also coordinated. Specifically, the network engages in coordinated posting activity where its accounts consistently post identical or nearly-identical (e.g., slightly paraphrased or rearranged) content.
This analysis collected posts from accounts suspected to be in the network between November 1, 2025 and March 9, 2026. It considered accounts to be part of this network if they engaged in at least one cluster of coordinated content. And so, definitionally, all 116 active accounts participate in at least one coordinated content cluster. In addition, 94 accounts in the network participated in at least 10 clusters; 46 accounts participated in at least 50 clusters; 16 accounts participated in more than 100 clusters; and 5 accounts participated in more than 200 clusters.
Figure: Network visualization of accounts that participated in at least 50 coordinated posting clusters. Node size is proportional to the number of distinct clusters each account participated in. Edge thickness is proportional to the amount of co-participation between two accounts, measured by how often they posted within the same coordinated clusters.
Within the collection period, the network posted 2,274 coordinated content clusters (i.e., content that is either identical or paraphrased and posted by at least two accounts in the network). 1,855 of these clusters were posted by the network 2–4 times; 354 clusters were posted 5–9 times; 50 clusters were posted 10–14 times; 13 clusters were posted 15–19 times; and 2 clusters were posted 20+ times. 1,974 clusters were posted by 2–4 accounts; 260 clusters by 5–9 accounts; 34 clusters by 10–14 accounts; 6 clusters by 15–16 accounts. These numbers demonstrate a high degree of coordinated posting activity across the network.
The largest coordinated content cluster includes Hebrew-language variants of a message stating that Israel is in an existential political crisis, that this crisis is as dangerous as Iran, that the Israeli government is more dangerous than Iran’s regime, and that immediate revolutionary action is necessary to overthrow it. This content was posted 22 times by 16 accounts in the network. Across these posts, the differences are limited to subtle changes in wording, register, and punctuation, while the overall structure and political message remain the same.
Figure: A sample of four posts from the largest coordinated content cluster. @WYylwn41269 and @shatz_david post identical messages while @DanielG_efen and @shera26116 each post slightly paraphrased variants.
A little under half of the network’s posts are replies. Moreover, of 17,589 replies in the dataset, 17,584 (99.97%) target accounts outside the 118-account network, likely to reach external audiences rather than create the impression of engagement with content posted by the network.
In addition to the network’s coordinated posting behavior, the timeline of the accounts’ creation dates are also compressed within a two year timeline. The earliest account in the network was created in May 2024. Over 90% of the accounts were created during or after January 2025, which is the month when Israel and Hamas reached their initial ceasefire agreement. The 2-year compressed timeline provides an additional indicator of coordination, albeit a weaker one than the posting patterns: from a random sample of over 100 authentic accounts, one would expect a broader temporal distribution than two years.
Key Narratives
Multiple key narratives persist throughout the network’s content. The most prevalent narrative demonizes the Israeli Prime Minister, Benjamin Netanyahu, characterizing him as the most pressing threat to Israel. The network’s posts often use words like “Traitor” (בוגד), “Swindler” (נוכל), and “Destroyer” (מחריב) when describing Netanyahu. Posts claim that Netanyahu is responsible for various wars, political decay in Israel, manipulating the public, and the collapse of Israeli institutions. Content posted by the network even includes the claim that Netanyahu has caused more damage to the Jewish people than anyone since Hitler, and that Netanyahu is more dangerous than Iran or Hamas.
Figure: A sample of four posts from a coordinated content cluster that attacks Benjamin Netanyahu.
Another key narrative is that the Israeli government has become a regime or theocracy, with Israel depicted as undergoing either democratic backsliding or collapse. Content communicating this narrative sometimes argues that elections are not a solution, and Israel instead needs revolution or uprising.
Figure: A sample of four posts from a coordinated content cluster depicting the Israeli government as undemocratic and dictatorial.
Another one of the network’s key narratives is that Netanyahu wages wars to preserve his power. Various claims include that the Israeli government is using war to distract the public, suspend elections, or create a permanent state of emergency.
Figure: A sample of four posts from a coordinated content cluster claiming that Netanyahu is waging war against Iran in an attempt to delay elections
Another key narrative frames internal Israeli actors—especially coalition politicians, right-wing ministers, settlers, and Haredi political blocs—as threats from within and, often, as the greatest threat to Israel. Posts frequently claim that these actors pose a greater danger to Israel than Hamas or Iran, with a particular focus on Haredi draft exemptions and the influence of right-wing ministers. Some posts go further, explicitly comparing Israeli politicians to Iran’s rulers, claiming that “there is no difference between the Ayatollahs in Iran and those here.”
Figure: A sample of four posts from a coordinated content cluster framing Haredim and settlers as a threat to Israeli society.
Another recurring narrative portrays the Israeli media as helping manufacture public consent for Netanyahu and for various wars, often using language such as “brainwashing” and “consciousness engineering.”
Figure: A sample of four posts from a coordinated content cluster claiming that the Israeli media is manipulating Israeli public consciousness.
Between the start of Operation Epic Fury (February 28) and the end of the collection period (March 9), the network increasingly leveraged the U.S.-Israeli strikes against Iran in its divisive narratives. These included claims that Netanyahu was using the conflict to preserve power, that people and politicians within Israel posed a greater threat than Iran, and that Israeli coverage of the Iran war was manipulative and propagandistic. As mentioned earlier, Iran-related narratives increased from 3% of all its content before February 28 to over 20% of its content afterwards.
Figure: A sample of four posts from a coordinated content cluster claiming that Iran does not want to eliminate Israelis, but Trump and Netanyahu do.
Attribution
The network appears to be a wing of the persistent Islamist influence campaign known as ISNAD. ISNAD’s TTPs and narratives closely align with those seen in the network discussed in this analysis. Previous TTPs associated with ISNAD include the following: impersonating Israelis on X and other platforms; posting coordinated messages that are slightly paraphrased to avoid detection; and primarily posting replies to authentic Israeli accounts. ISNAD’s narratives exploit divisive political and social topics within Israel, often heavily criticizing the Israeli government. More specific narratives associated with ISNAD include attacking Netanyahu, accusing the Israeli government of failing to protect its citizens, criticizing Haredim and settlers, and occasional calls for uprisings or revolution.
ISNAD’s participants come from regions across the globe including West Asia, North Africa, and Europe, which aligns with the location data of most accounts in the network discussed in this analysis. Additionally, many of the accounts appear to attempt to mask their location with a VPN, which is also a TTP associated with ISNAD.
Given that many of the accounts have metadata on X showing their location is in “Western Asia,” it is possible that there is some Iranian participation in this network. Iranians also have impersonated Israelis in the past. However, nothing specifically indicates Iranian involvement, as this metadata could also be associated with one of over a dozen other West Asian countries. The most plausible attribution of this network is to ISNAD, rather than Iran.
The network’s activity demonstrates how ISNAD’s crowdsourced, “grassroots” influence operations can achieve persistence and rapidly adapt to emerging events to destabilize Israeli society.