When avatars come alive: understanding hybrid threat actors

When avatars come alive: understanding hybrid threat actors

Speakers: Itay Cohen, Unit 42 Researcher, Palo Alto Networks; Omer Benjakob, Journalist, Haaretz

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=HmK6AcBueak

Overview

In an increasingly complex threat landscape, the traditional distinctions between cyber warfare, disinformation campaigns, and kinetic (physical) attacks are rapidly dissolving. This pivotal talk, "When avatars come alive: understanding hybrid threat actors," presented by Itay Cohen of Palo Alto Networks Unit 42 and journalist Omer Benjakob of Haaretz, introduces a critical new framework: Hybrid Threat Actors (HDAs). The speakers argue that these state-sponsored entities or their proxies seamlessly blend digital and physical actions into a unified, continuous attack chain, challenging conventional security paradigms and demanding a holistic defensive approach.

The presentation delves into a series of alarming real-world cases, primarily focusing on Iranian intelligence operations against Israel, to illustrate how online influence and cyber intrusions are no longer isolated digital phenomena but direct enablers of real-world harm, including surveillance, sabotage, and even assassination plots. Through personal anecdotes, detailed case studies, and revelations from Israeli security services, Cohen and Benjakob compellingly demonstrate that the "clicks to chaos" pipeline is a present and escalating danger, necessitating a fundamental shift in how security professionals, policymakers, and the public perceive and counter modern threats.

The talk underscores the urgent need to bridge what the speakers term the "fimakuna"—a critical security lacuna stemming from the historical reluctance of cybersecurity researchers to engage with content-related issues and the inability of social media platforms to adequately address disinformation as a national security threat. By presenting a unified threat model, Cohen and Benjakob advocate for integrated intelligence, cross-domain collaboration, and a re-evaluation of security priorities to effectively combat these evolving and increasingly dangerous hybrid operations.

Background

▶ Watch: Digital influence metastasizes into physical reality (3:59)

Historically, the security community has operated within distinct silos when analyzing threat actors and their methodologies. Influence operations were often dismissed as mere "trolling" or "noise," cyberattacks were primarily associated with data theft or system disruption, and kinetic threats were largely the purview of counterterrorism agencies. This compartmentalized thinking, while providing a structured approach to specific threats, fails to account for a more insidious and integrated form of aggression. The core premise of this talk is that these seemingly disparate domains are increasingly converging, often orchestrated by the same state-sponsored entities.

Omer Benjakob's personal experience serves as a stark illustration of this convergence. As a journalist investigating disinformation, he received a death threat in the mail—a physical manifestation directly linked to a large disinformation network he had previously exposed. This threat, delivered both via courier and WhatsApp, originated from an account connected to the very network he had ethically disclosed to Meta and Telegram, leading to the takedown of numerous inauthentic accounts involved in inciting the Israeli public. This incident underscored for Benjakob and Cohen that digital disinformation is not confined to the online realm but "metastasizes and penetrates into our reality," demanding a unified analytical framework.

The urgency of this issue has been further amplified in Israel, where security services, particularly the Shinbet, have for the first time openly discussed the role of social media in national security threats. Since October 7th, 2023, the Shinbet has exposed 23 different cases of Israeli nationals recruited by Iran via Telegram to act as agents within the country. These cases highlight a shift from conventional Advanced Persistent Threats (APTs), which typically focus on long-term infiltration for espionage or disruption, to a new breed of Hybrid Threat Actors (HDAs). HDAs, as conceptualized by Cohen and Benjakob, are state-sponsored groups or proxy entities that seamlessly combine physical and cyber actions into a continuous and integrated attack chain, moving fluidly between the "silos" that traditional security frameworks have created. This evolving threat landscape necessitates a holistic understanding that recognizes the interconnectedness of digital and physical domains.

Key Findings

▶ Watch: Vladislav Victor Sony: from graffiti to assassination (6:20)

The central revelation of this talk is the emergence and operationalization of Hybrid Threat Actors (HDAs), characterized by their ability to blend actions from physical and cyber domains into a unified, continuous attack chain. The speakers rigorously define HDAs as actors who leverage cyber intrusion and disinformation as preparatory stages, gathering intelligence and manipulating targets to directly enable physical harm, including assassination attempts, surveillance, kinetic strikes, and sabotage. This creates a dangerous cycle where digital actions not only facilitate physical threats but are also amplified by online influence, and vice versa.

A critical finding is the identification of the "clicks to chaos" pipeline, a systematic methodology for recruiting and operationalizing agents for physical acts. This pipeline targets specific vulnerable demographics:

• Chronically Online: Individuals who spend significant time online, particularly on platforms like Telegram, which is noted to be a specific arena for recruitment in the Israeli context.
• Socially Isolated: Individuals lacking strong community ties, making them more susceptible to external influence and illicit recruitment.
• Financially Desperate: Those in need of work that may not fit into conventional legal employment, making them vulnerable to illicit "job offers."
• Marginalized Groups/Immigrants: In the Israeli context, many recruited individuals were immigrants or from marginalized communities, often with limited legal work opportunities.
• Criminal Records: Individuals with prior criminal histories, who may face barriers to legitimate employment and be more amenable to illegal activities.

The operational model for enlistment within this pipeline is chillingly consistent:

1. Initial Contact: Through disinformation groups or fake job offers on platforms like Telegram.
2. Minor Tasks: Recruits are given low-risk assignments such as opening new groups, posting memes, or taking photos.
3. Escalation: Tasks gradually escalate to more dangerous activities, including arson, sabotage, surveillance, and ultimately, assassination plots.

Iran's specific targeting patterns against Israeli individuals represent a significant key finding. The Shinbet reported approximately 300 highly targeted cyberattacks aimed at individuals, including journalists, academics, politicians, and security officials. The primary objective of these attacks was to steal highly personal details such as schedules, travel information, home addresses, and family data. This intelligence was then used to facilitate physical assassination attempts by the recruited cells, underscoring the direct link between stolen digital information and real-world kinetic operations.

Finally, the talk highlights the "fimakuna" (foreign intervention lacuna) as a critical systemic vulnerability. This gap arises from the historical reluctance of cybersecurity researchers to engage with the complex, content-agnostic nature of disinformation campaigns and the persistent framing by social media platforms of disinformation as merely an "inauthentic" issue, rather than a national security threat. This lacuna leaves a gaping hole in collective security, enabling HDAs to operate effectively at the intersection of digital influence and physical violence. The speakers argue that closing this gap requires a fundamental shift in perspective, recognizing that disinformation and influence operations are national security issues demanding integrated responses from cybersecurity, law enforcement, and social media platforms.

Technical Deep Dive

▶ Watch: Understanding the 'Clicks to Chaos' recruitment pipeline (14:00)

The technical deep dive into Hybrid Threat Actors reveals a sophisticated, multi-layered approach that seamlessly integrates cyber and physical methodologies. The operational framework starts with digital reconnaissance and recruitment, progressing to physical action, often reinforced by further cyber-psychological operations.

Recruitment and Digital Infrastructure:

The initial phase of HDA operations heavily relies on social media platforms, particularly Telegram, for recruitment and tasking. Cases like Vladislav Victor Sony, recruited via a Telegram group called "the stoner's hearts," exemplify this. Iranian agents, operating under fake profiles, offer seemingly easy gigs, such as spray-painting graffiti for crypto payments ($20 per slogan). These tasks gradually escalate to more sensitive operations, including scouting political protests, dropping off cash, picking up ammunition/weapons, recruiting homeless individuals, and ultimately, arson and assassination plots ($100,000 for a public figure, $40,000 for a "cheaper hit").

Another significant case, Eden Dabas, illustrates the dual role of recruits. Beyond physical tasks like posting graffiti and propaganda to amplify online disinformation in the streets, Dabas was also instrumental in setting up digital infrastructure for his Iranian handlers. This involved purchasing phones and SIM cards on their instructions and establishing Telegram groups, such as "Am Yisrael" (The People's Army), a populist-themed group. He also bought additional SIM cards and created fake accounts, demonstrating the integration of physical agents into the digital operational chain. Interestingly, Dabas also exploited his handlers' inability to verify his actions, lying about completed tasks to receive payment, highlighting a potential vulnerability in the HDA's command and control.

The Kyifa 7 case further demonstrates the escalation of recruitment. This group of seven Azerbaijani immigrants, recruited through a single Telegram ring, performed over 600 missions. These missions were not just about influence but involved serious espionage, including attempts to penetrate air bases and document military sites, showcasing the direct pipeline from social media recruitment to high-stakes intelligence gathering.

Cyber-Kinetic Linkages and Targeting:

The talk provides compelling evidence of how cyber operations directly inform and enable kinetic actions:

1. Nevatim Air Base Incident:

• Cyber-Psychological Operation: In October 2023, a cyber persona named "Soldier of Solomon" claimed to have hacked and leaked security camera footage from Israel's Nevatim Air Base. This data was shared on Telegram.
• Disinformation/Perception Shaping: Analysts from Microsoft Threat Intelligence Center subsequently revealed that the footage was not from the military air base but from a civilian street coincidentally named Nevatim Street. Despite the technical inaccuracy, the psychological effect was real, creating fear and the perception that Iran could access highly protected Israeli sites.
• Human Surveillance/Kinetic Enablement: Concurrently, the recruited Kyifa 7 cell was tasked with physically monitoring and photographing the Nevatim Air Base and tracking its commander and his son for assassination.
• Kinetic Strike & Reinforcement: On October 1st, 2024, Iran launched a major missile strike against Israel, with the Nevatim Air Base being among the targeted sites. Crucially, the "Soldier of Solomon" cyber persona was among the first to publish videos of the hits on Telegram, reinforcing the perception of Iranian capabilities and the integrated nature of their operations. This demonstrates a clear sequence: cyber disinformation -> human surveillance for targeting -> kinetic strike -> cyber amplification.

1. Civilian Weapons Database Leak:

• In early 2025, the Iranian group Hanela leaked an Israeli database containing sensitive information about civilian weapon owners, including names, home addresses, ammunition quantities, weapon types, and storage methods.
• Intelligence for Sourcing/Recruitment: While direct evidence is lacking, Israeli authorities reported that recruited cells were tasked with collecting weapons and ammunition from various pickup spots. The leaked database could serve as a "roadmap" for sourcing weapons or identifying vulnerable individuals who own weapons for potential recruitment.

1. Targeted Phishing and Impersonation for Assassination:

• The Shinbet reported approximately 300 highly targeted cyberattacks against individuals, specifically aiming to steal personal details like schedules, travel information, and daily routines.
• Checkpoint Research detailed an Iranian campaign where operators hacked high-value individuals' email accounts, then hijacked ongoing email threads to lure new victims abroad for meetings that would end in abduction or assault.
• Real-World Assassination Plot: In late 2023, former Israeli Defense Minister Moshe Ya'alon was targeted for assassination during his morning run in Tel Aviv. A local cell, working for Iran, planted a bomb along his route. Though the bomb exploded prematurely, the meticulous planning—knowing his exact running route, time, and frequency—strongly implicates the use of stolen schedule data obtained via cyber means. This was explicitly confirmed by the Shinbet. Former US National Security Advisor John Bolton also attested to Iran targeting his schedule and travel data for similar reasons.

Broader Context: Russia's GRU Unit 2955:

The HDA model is not exclusive to Iran. Russia's GRU Unit 2955, historically responsible for political coups, assassinations, poisonings, and sabotage, expanded its tradecraft to include cyber operations around 2020. This unit was responsible for the WhisperGate malware deployed against Ukrainian government infrastructure during the opening salvos of Russia's full-scale invasion. This demonstrates that sophisticated state actors are increasingly integrating cyber capabilities into their kinetic and influence operations from day one, planning integrated campaigns where digital and physical actions are interdependent elements of a larger hybrid strategy.

The refined definition of HDAs encapsulates these observations: they "use cyber intrusion and disinformation as preparatory stages to gather intelligence and manipulate targets directly enabling physical harm like assassination attempts, surveillance, kinetic strike, sabotage and more." This creates a continuous cycle where digital actions empower physical threats, which in turn amplify online influence, reinforcing the entire attack chain.

Demo / Proof of Concept

▶ Watch: Former Defense Minister targeted for assassination using cyber intel (22:00)

While the talk did not feature a traditional software demonstration or proof of concept in the sense of showcasing a specific tool or exploit, the speakers presented numerous real-world case studies and detailed operational methodologies that served as compelling demonstrations of the Hybrid Threat Actor (HDA) model in action. The meticulous dissection of cases like Vladislav Victor Sony's recruitment for graffiti and arson, Eden Dabas's dual role in physical propaganda and digital infrastructure setup, the Kyifa 7 cell's espionage and surveillance missions, and the sophisticated cyber-kinetic integration seen in the Nevatim Air Base incident and the assassination attempt on Moshe Ya'alon, collectively functioned as a powerful, real-world proof of concept for their proposed framework. These examples, drawn from public indictments and security service disclosures, provided concrete evidence of how digital activities directly translate into physical harm, illustrating the "clicks to chaos" pipeline with undeniable clarity.

Defensive Implications

▶ Watch: The 'Fimacuna': a critical gap in national security (27:00)

The rise of Hybrid Threat Actors necessitates a radical re-evaluation of defensive strategies, moving beyond traditional siloed approaches. The implications for defenders span intelligence gathering, organizational security, individual protection, and policy reform.

1. Adopt a Unified Threat Model: The most critical implication is the abandonment of compartmentalized thinking. Security teams must integrate intelligence streams from cyber threats, disinformation campaigns, and physical security incidents. This means cyber threat intelligence must not only analyze malware and network intrusions but also monitor social media for influence operations, recruitment tactics, and psychological operations. Physical security teams, in turn, need to be aware of digital reconnaissance and targeting.

1. Enhanced Threat Intelligence and Behavioral Analysis: Defenders need to proactively identify and track HDAs by understanding their modus operandi. This includes monitoring platforms like Telegram for suspicious groups, fake job offers, and escalating task assignments that align with the "clicks to chaos" pipeline. Intelligence should focus on the entire attack chain, from initial online contact to potential physical manifestation. Identifying the demographic profiles targeted for recruitment (chronically online, socially isolated, financially desperate, marginalized groups, criminal records) can help in developing targeted counter-recruitment and awareness campaigns.

1. Protecting High-Value Individuals and Sensitive Data: Given the HDA's focus on stealing personal details to enable kinetic attacks, organizations must implement robust security measures for high-value individuals (executives, politicians, journalists, security personnel). This includes:

• Advanced Phishing Defenses: Strengthening email and messaging security to detect highly targeted phishing attempts (e.g., those hijacking ongoing email threads).
• Data Privacy and Access Control: Strictly limiting access to and protecting sensitive personal data such as schedules, travel itineraries, home addresses, and family information.
• Personal Cyber Hygiene Training: Educating individuals on the risks of oversharing personal information online and recognizing social engineering tactics.
• Physical Security Integration: Coordinating with physical security teams to assess risks derived from digital intelligence, especially for individuals whose data might have been compromised.

1. Addressing the "Fimakuna" (Foreign Intervention Lacuna): This requires systemic changes:

• Cross-Domain Collaboration: Cybersecurity researchers, law enforcement, intelligence agencies, and social media platforms must collaborate more effectively. Cybersecurity professionals need to overcome their historical "content-agnostic" stance and engage with the analysis of disinformation campaigns as a national security issue.
• Platform Accountability: Social media companies must move beyond merely flagging "inauthentic behavior" and recognize the profound national security implications of disinformation and influence operations. They need to invest more in proactive threat detection, information sharing with security services, and transparently addressing state-sponsored abuse.
• Policy and Regulation: Governments need to develop policies that bridge the gap between cybercrime, counter-terrorism, and social media regulation, creating clear frameworks for intervention and accountability.

1. Supply Chain and Critical Infrastructure Security: The Nevatim Air Base incident highlights the need for constant vigilance against psychological operations that aim to undermine trust and create fear, even if technically inaccurate. Critical infrastructure operators must not only secure their physical and digital assets but also be prepared to counter coordinated disinformation campaigns that accompany or precede physical attacks. The civilian weapons database leak underscores the need for robust data security across all sectors, as seemingly benign data can be weaponized.

Ultimately, defending against Hybrid Threat Actors requires a paradigm shift: recognizing that the internet is not a separate, virtual realm but an integral and often preparatory battleground for real-world conflicts. Defensive strategies must be as integrated and agile as the threats they aim to counter.

Key Takeaways

• Hybrid Threat Actors (HDAs) are a unified, integrated threat model: They seamlessly blend cyber intrusions, disinformation, and kinetic actions into a continuous attack chain, challenging traditional, siloed security approaches.
• Digital activities are direct enablers of physical harm: Cyberattacks and influence operations are used as preparatory stages to gather intelligence (e.g., schedules, addresses) and manipulate targets, directly leading to real-world outcomes like surveillance, sabotage, and assassination plots.
• The "clicks to chaos" pipeline targets vulnerable individuals: HDAs systematically recruit individuals who are chronically online, socially isolated, financially desperate, from marginalized groups, or have criminal records, using platforms like Telegram for initial contact and escalating tasks from minor online activities to serious physical crimes.
• Personal data is a weaponized asset: Highly personal details such as daily routines, travel information, and home addresses, often stolen through targeted phishing or account takeovers, are critical intelligence for HDAs to plan and execute physical attacks.
• The "fimakuna" represents a critical security gap: A lacuna exists due to the historical content-agnostic approach of cybersecurity research and the inadequate response of social media platforms to disinformation as a national security threat, leaving a vulnerability that HDAs exploit.
• Integrated defense and cross-domain collaboration are essential: Countering HDAs requires a fundamental shift in defensive strategy, fostering collaboration between cyber security, physical security, intelligence agencies, and social media companies to create a holistic and unified response.

About the Speaker(s)

Itay Cohen is a Unit 42 Researcher at Palo Alto Networks, a prominent cybersecurity company. His work involves in-depth research into evolving threat landscapes, contributing to the understanding and defense against sophisticated cyber adversaries. Beyond his professional role, Cohen is also an activist, dedicating much of his free time to political and social causes, with a particular focus on animal welfare.

Omer Benjakob is a respected journalist for Haaretz, Israel's only remaining daily newspaper. His journalistic focus lies in disinformation, cyber security, and national security investigations. Benjakob's personal experience of receiving a death threat directly linked to his reporting on disinformation networks underscores the real-world implications of the threats he covers, highlighting the critical intersection of digital influence and physical danger.