Iran's Evolving Cyber-Enabled Influence Operations to Support Hamas

**Executive summary:** Microsoft Threat Intelligence observed coordinated Iran-backed and Iran-affiliated cyber-enabled influence operations supporting Hamas that employ impersonation/sockpuppets, activation of targeted audiences, bulk text/email amplification, state-media amplification, and disruptive cyber methods (e.g., DDoS and alleged PLC attacks); activity has expanded internationally, uses AI-generated media to fabricate evidence, and involves groups such as Cotton Sandstorm operating multiple personas to amplify misleading narratives and claims of destructive cyber activity.