New Deep and Dark Web Collections Regarding the Israel-Hamas War

Executive Summary

• With the outbreak of the ongoing war between Israel and Hamas, SecurityScorecard rapidly expanded its deep and dark web (DDW) collections to include messaging channels affiliated with Hamas and other militant groups.
  • The SecurityScorecard Threat Research, Intelligence, Knowledge, and Engagement (STRIKE) Team combined automated analysis of these collections using SecurityScorecard’s large language model (LLM) with its researchers’ regional expertise to derive insights into these channels.
• These channels likely reflect the official positions of the groups for which they speak.
  • They are, therefore, unlikely to offer details regarding kinetic operations prior to their start or otherwise disclose information that could compromise the groups’ activities.
  • They are, however, likely to offer a more detailed view of the groups’ political priorities and international orientation than major English-language media.
• Messages posted in Hamas-affiliated channels highlighting praise for Hamas’ attacks from parties outside of Gaza likely reflect the group’s awareness of the international scope of the conflict. They may represent an attempt to boost morale among a local audience by publicizing external expressions of support.
• In light of ongoing concerns over the possibility that the conflict will expand beyond Gaza’s borders and escalate into a regional conflagration, these messages may additionally help chart possible courses along which such an escalation could occur by identifying the specific external locations and parties with orientations similar to Hamas’s.

Background

With the outbreak of the ongoing war between Israel and Hamas following the attacks Hamas conducted on October 7, which the group refers to as an operation called Tufan Al-Aqsa (variously translated as the “the Storm of Al-Aqsa,” “the Flood of al-Aqsa,” “al-Aqsa Storm,” and others), SecurityScorecard rapidly expanded its deep and dark web (DDW) collections. This effort gathered intelligence from messaging channels affiliated with Hamas and other militant groups, including both the Iranian and Lebanese Hezbollah movements, which share a broadly similar orientation toward Israel despite differences from Hamas in both sectarian and political outlooks.

As of October 17, these collections contain approximately 20,000messages. The STRIKE Team first used SecurityScorecard LLM to automate the analysis of such a large volume of messages and identify some of the key conclusions these messages support. STRIKE Team researchers subsequently complemented this automated and volume-driven analysis with their regional expertise to identify content that, while less numerically significant than the messages that support broad conclusions regarding the attacks, offers insights into the priorities and international orientation of the groups circulating them.

Findings

These channels likely reflect the official positions of the groups for which they speak. They are therefore, unlikely to offer details regarding kinetic operations prior to their start or otherwise disclose information that could compromise the groups’ activities. They are, however, likely to offer a more detailed view of the groups’ political priorities and international orientation than major English-language media.

Speaking broadly, SecurityScorecard LLM’s conclusions regarding the channels’ account of the attacks mirror the public reporting fairly closely. According to this analysis, Hamas claimed responsibility for the attacks. And in a statement, the spokesperson for the military wing of Hamas, known as the Al-Qassam Brigades, confirmed it. This operation involved the launching of 3,500 rockets and artillery shells against Israeli military positions near the Gaza Strip. The statement did not provide specific details about the targets that were hit, but it mentioned that the operation targeted the Israeli army’s Gaza Division. It is important to note that the Gaza Division is responsible for overseeing Israeli military operations in the Gaza Strip. Additionally, the statement mentioned that the Al-Qassam Brigades launched a strike of 150 rockets towards the Israeli city of Ashkelon.

While a summary of the channels’ descriptions of kinetic operations may resemble those available in more traditional journalistic outlets, their contents can also, upon a closer reading, yield additional insights into Hamas’s messaging surrounding these operations. English-language news sites and these channels both reported new rocket attacks against Israeli cities on October 16, on which date the Telegram channel “حماس | Hamas | فلسطين | غزة” (“Hamas | Gaza | Palestine”) circulated messages that read, “The brigades cover the occupied territories with missiles” and “all of historical Palestine [all of Israel] is under the strikes of the resistance [Hamas].”

While messages like the above do not offer clear tactical intelligence distinguishing them from more readily available public reporting, they do offer insight into Hamas’s approach to publicity regarding these attacks. While the more widely-available English-language reporting mentions attacks on particular Israeli cities, the above messages amount to a claim that Hamas can launch attacks against sites anywhere in Israel, which may serve to advertise the group’s capabilities and undermine claims regarding Israel’s defensive capabilities by claiming that anywhere in Israel could be vulnerable.

Also on October 16, an Iranian Hezbollah channel, کانال مقاومت اسلامی حزب الله (“The Channel of the Hezbollah Islamic Resistance Movement”), shared footage of rocket strikes, captioning it “elon under the fire of the Resistance. Combatants from the Qassam Brigades conducted heavy rocket attacks against Tel Aviv. [The] Qassam [Brigades] announced that these attacks were conducted in response to the crimes of the Zionist regime against non-combatants in Gaza.”

The circulation of images and reports of Hamas rocket attacks by an Iranian Hezbollah channel may reflect that movement’s sympathy with (and, by extension, official Iranian support for) Hamas, despite the groups’ sectarian differences.

As Israel’s response to Hamas’s initial attacks has proceeded, the STRIKE Team has observed the channels circulating content framing that response in a light favorable to Hamas. On October 16, a channel circulated a report that Hamas had informed the family of an Israeli hostage that the hostage died in an Israeli airstrike against Gaza, writing, “Breaking | Israeli Channel 13: Hamas sent photos to the family of one of the hostages and explained to them that he had died in an Israeli airstrike on Gaza.”

A report of a hostage’s death could, in general, help Hamas shape a narrative favorable to itself by undermining Israel’s perceived ability to protect its citizens.But the claim that such a death occurred specifically as a result of an Israeli airstrike may represent an attempt to undermine support for such strikes by calling their precision into question and suggesting that they can result in Israeli deaths in addition to Palestinian ones.

Other messages highlighting praise for Hamas’s attacks from parties outside of Gaza likely reflect the group’s awareness of the international scope of the conflict and may represent an attempt to boost morale among a local audience by publicizing external expressions of support.

Messages posted to two Telegram channels, “حماس | Hamas | فلسطين | غزة” (“Hamas | Gaza | Palestine”) and “الحركة الاسلامية | الضفة المحتلة” (“The Islamic Movement | The Occupied West Bank”), highlight Iraqi expressions of support for Hamas’s recent operation. One such message from a Shi’i paramilitary group widely understood to be an Iranian proxy may be particularly worthy of note, given Iran’s support for Hamas.

On October 7, the following appeared in the “حماس | Hamas | فلسطين | غزة” (“Hamas | Gaza | Palestine”) Telegram channel: “Abu al-Ala’ al-Wala’i, the General Secretary of the Sayyid al-Shuhada’ Brigades¹Kata’ib Sayyid al-Shuhada’; Sayyid al-Shuhada’ roughly translates to “the Lord [or Master] of the Martyrs” and is an epithet for Husayn ibn ‘Ali, a grandson of the Prophet Muhammad and third Imam of the Shi’ah. Kata’ib Sayyid al-Shuhada’ is an Iranian-backed Shi’i paramilitary group based in Iraq.
announced [the Brigades’] total preparedness to defend Palestine’s land, people, and holy sites.”

Similarly, these channels highlighted celebrations of Hamas’s attacks in Basra and Baghdad, both of which are Shi’i-majority cities in Iraq.

On October 7, “hamaswestbank” reported celebrations of the operation in Baghdad in the channel “الحركة الاسلامية | الضفة المحتلة” (“The Islamic Movement | The Occupied West Bank”) channel. One reads, “celebrations in the streets of Baghdad after the announcement of Operation al-Aqsa Storm and the capture of soldiers from inside the occupied territories,” and the other reads, “a building in the Iraqi capital decorated with the flag of Palestine and the name of the current operation against the Israeli occupation.”

Message Time (Unix Timestamp)	Message Time (GMT)	Arabic Message	English Translation
1696697464	October 7, 2023 4:51:04 PM	احتفالات في شوارع بغداد، بعد الإعلان عن معركة “طوفان الأقصى” وأسر جنود من داخل الأراضي المحتلة مبانٍ في العاصمة العراقية بغداد، تتزين بعلم فلسطين واسم المعركة الحالية ضد الاحتلال الإسرائيلي	A building in the Iraqi capital decorated with the flag of Palestine and the name of the current operation against the Israeli occupation
1696701240	October 7, 2023 5:54:00 PM	احتفالات في شوارع بغداد، بعد الإعلان عن معركة “طوفان الأقصى” وأسر جنود من داخل الأراضي المحتلة	Celebrations in the streets of Baghdad after the announcement of Operation al-Aqsa Storm and the capture of soldiers from inside the occupied territories

 

Later, on October 12, “حماس | Hamas | فلسطين | غزة” (“Hamas | Gaza | Palestine”), shared a video captioned “Basra celebrates the victory of the al-Aqsa Storm.”

Conclusion

Given its origins in Sunni revivalism, Hamas’ sectarian orientation has, in other contexts, led it to oppose other (usually Shi’i) groups that enjoy Iranian support. For example, Hezbollah and Iraqi paramilitary groups such as Kata’ib Sayyid al-Shuhada’ (mentioned above) supported factions opposing those Hamas supported in the Syrian Civil War. Indeed, previous commentary assessed that the Syrian Civil War had undermined “the Axis of Resistance” (a term referring to a network of Iranian-supported groups united by their opposition to the U.S. and Israel) by exaggerating the sectarian differences between its Sunni and Shi’i members.

However, the above messages suggest that Hamas and other Iranian-supported paramilitary groups (including those from parties with dramatically different, if not perennially opposed, approaches to religion) both aim to highlight expressions of international support for Operation al-Aqsa Storm.This suggests an awareness of their international audience and the possibilities of regional escalation, as well as the possibility that other members of the Axis of Resistance could participate in a wider conflict, should one result from that escalation.

In light of ongoing concerns over the possibility that the conflict will expand beyond Gaza and escalate into a regional conflagration, these messages may help chart possible courses along which such an escalation could unfold. Even in the absence of evidence that its engagement in the conflict will take on operational dimensions in addition to rhetorical ones, Iran has figured prominently in English-language coverage of a possible escalation. The messages discussed above may reflect a similar tendency, as they can highlight the mutual sympathy of Hamas on the one hand, and Iran and its Shi’i proxies elsewhere in the region on the other.

---

[1] Kata’ib Sayyid al-Shuhada’; Sayyid al-Shuhada’ roughly translates to “the Lord [or Master] of the Martyrs” and is an epithet for Husayn ibn ‘Ali, a grandson of the Prophet Muhammad and third Imam of the Shi’ah. Kata’ib Sayyid al-Shuhada’ is an Iranian-backed Shi’i paramilitary group based in Iraq.