Insider Risk Watch #4: Propaganda as a method of hybrid warfare

While in the past foreign propaganda leaflets were dropped from the sky, states at war now have the unprecedented ability to reach millions of its enemy's citizens through content they will voluntarily watch, share, and internalise as mere entertainment. Social media and AI have made this process scalable, cheap, and nearly invisible in the kinetic world.

Over time, a meaningful portion of that exposed population will begin to see the world the way their adversary wants them to: whether it is through distrust in their own government, sympathy to the other side's grievances, or the unwillingness to support the war effort. Modern influence operations are designed to produce insiders, not through direct recruitment but rather by creating the perception of enlightenment, and subsequent voluntary action.

When discussing the goals of war propaganda, the people are usually conceptualised as one singular entity. However, the impact that public opinion can have on its society extends far beyond the ballot box. Other states are well aware of that, and leveraging the community sentiments of foreign nationals is becoming an important tactic of hybrid warfare. A country’s citizenry is constituted of individuals who all have individual lives, and jobs. Some work at power grids, water treatment plants, rail networks, and port facilities, namely within highly sensitive critical infrastructure that, if compromised, would severely cripple one country’s ability to defend itself.

When the timeline became the frontline

The idea that social media could be a geopolitical weapon first became impossible to ignore in December 2010, when images of Mohamed Bouazizi's self-immolation spread across Facebook within hours of the event, igniting the Arab Spring. Governments that had spent decades controlling information flows suddenly found themselves outflanked by peer-to-peer networks they had no mechanism to stop. The internet, briefly, looked like an instrument of popular liberation. However, every actor in subsequent conflicts quickly grasped the same lesson and started using the same tools to pursue their own objectives.

Following the outbreak of the Arab Spring in Syria, weaponised social media was simultaneously used to recruit fighters, document atrocities, attribute blame, and appeal for foreign support. For example, ISIS produced slick, globally distributed propaganda videos calibrated for Western-raised recruits searching for identity and purpose, achieving vast reach and significant success in recruitment. Moving West towards Ukraine, starting in 2014 Russia deployed a sustained information operation mixing genuine conflict footage with fabricated narratives, making attribution permanently contested and rally support, especially in already precarious regions such as the Donbass and Donetsk. In Sudan, warring factions flooded platforms with contradictory accounts of the same events, generating a fog dense enough to paralyse both external intervention and domestic resistance. During the Gaza conflict, both sides' supporters fought an intense battle for global opinion on TikTok and Instagram, reaching hundreds of millions who had never previously thought about the region.

Across these examples, the information campaign was not an accessory to the conflict, but for weaker parties facing stronger conventional opponents, it was often the primary front, accessible by the state and non-state actors alike. In each case, the target were not the enemy’s forces – as it had been the case, for example, with Hanoi Hannah during the Vietnam War, as her broadcast aimed at eroding their morale – but the enemy's population and their will to support the war, their trust in their government, their sense of who the aggressor was. While the objectives of modern propaganda per se do not differ from past instances, social media has granted every actor, state or non-, involved in the conflict the tools to pursue it a lot more quickly, cheaply, and with far greater reach. What changes with scale and speed is not just the size of the audience reached, but also its granularity: these tools can move populations in the aggregate because they can move individuals, one algorithm-optimised feed at a time, each with their own job title and their own level of access. Access is the variable that turns an influence operation from a problem of public opinion into a problem of security, as swaying the view of someone who can disable an entire system with a click creates vulnerabilities within state borders.

Old dog, new tricks

Propaganda aimed at a foreign population has had the consistent goal of eroding the enemy’s willingness and capability to fight back across history. During World War I, the Allies flooded neutral and enemy populations with atrocity stories, turning American public opinion against Germany even before the US entered the war.

The mechanics also remained consistent in first finding the fault lines inside the target society – such as class resentment, ethnic tension, distrust of elites – and leveraging them. The most effective propaganda has a way of attaching itself to real grievances and amplify them, because real grievances are the ones that will hit closest to home, and that people are more likely to defend against debunking.

What social media and AI have changed is not the goal or the mechanics, but its scale, cost and, most importantly, its invisibility. Content that arrives through a social feed, indistinguishable from domestic satire and entertainment, has the chance to bypass the scepticism people apply to foreign state media entirely. In addition, as platform algorithms reward engagement above all else, they actively promote content engineered to provoke outrage, mockery, and solidarity: all that influence operations seek to achieve.

In this context, the newly coined concept of TikTok war assumes a new relevance. These viral campaigns are not merely a real-time documentation of events spiced with some commentary, but increasingly coordinated influence operations using the language and register of online content (raw, funny, irreverent, and emotionally direct) to deliver state propaganda in a format that its audience will not identify as such and therefore will be more likely to accept and internalise.

The Lego campaign: a case study

Iran's current AI propaganda campaign is the most technically sophisticated public example of this strategy in operation. Since March 2026, about a month since the opening strikes on Iran, an account called Explosive Media has flooded all the major social media platforms with AI-generated videos of Trump and Netanyahu as Lego figurines while other Lego military commanders rap over gangster beats. The recurring themes of such videos is the depiction of the United States as a global oppressor, and the video makers play heavily on the recent Epstein scandal and other salient elements in US politics.

The BBC's investigation revealed the Iranian government is a customer of the operation. What makes the campaign significant is its audience strategy, as these videos set out to talk about geopolitics to anyone, not necessarily those who are already interested. This strategy can especially effective with those who have consciously opted out of political news and have built an identity around scepticism of mainstream media, as they will encounter Iranian state messaging as entertainment, unable to distinguish it from domestic satire. This approach reveals itself to be especially fitting is we consider the political environment of the population it targets, namely a generation of Americans has spent two decades learning to process politics through comedy such as with The Daily Show or Last Week Tonight. That cultural conditioning trained an audience to lower its guard when political content arrives in a funny or irreverent format.

What does this mean for organisations?

The insider risk that propaganda produces is usually framed as a national security problem, but that framing misses most of the risk that matters to private organisations.

The realistic endpoint of a sustained influence operation is not a workforce full of apparent enemy agents, but rather one whose political polarisation has slowly and quietly intensified. In such a scenario, employees hold increasingly incompatible views of current events, their trust in institutions has eroded, and within the workforce a small but meaningful minority may have been radicalised to the point where ideological conviction overrides professional loyalty.

That process has direct, practical consequences at every stage. At the broadest level, employees exposed to sustained polarising content, regardless of its affiliation, may bring that polarisation into the workplace. Geopolitical conflicts that dominate social feeds can create visible cracks in teams between colleagues who hold opposing views on a war, on their government's role in it, on who the victims are. This weakens the psychological safety and cohesion that productive organisations depend on, and it generates a management burden that most organisations are not equipped to handle.

Further along the spectrum, some employees may begin to act on their convictions in ways that create direct risk for the organisations they work for. These acts do not necessarily require coordination with a foreign state as they can be as straightforward as leaking sensitive information to journalists or activist groups because an employee believes their employer is complicit in something wrong; sharing proprietary data with external parties whose stated cause they support; or sabotaging projects and partnerships that conflict with their ideological position. They are documented patterns across sectors, and their frequency increases when the external political environment is highly charged.

The criticality of infrastructure

All of this becomes substantially more dangerous in the context of hybrid warfare, namely the tactic of pursuing strategic objectives through means that fall deliberately below the threshold of open conflict. Cyberattacks on power grids, sabotage of logistics networks, interference in elections, the covert recruitment of local proxies for arson and vandalism are deniable and they rely on exploiting human access as much as technical vulnerabilities. The primary target, therefore, shifts from system to the people operating it.

Critical infrastructure is run by people who read the news (or increasingly do not), who consume social media, and who have been subject to years of algorithmically amplified political polarisation. An adversary conducting a hybrid campaign does not need to breach a firewall from the outside if it can cultivate, over time, an individual on the inside whose convictions have drifted far enough that they are willing to look the other way or actively do something they are not supposed to.

This is why the propagation of ideologically motivated insiders is more than HR problem or a question of workforce morale. In sectors critical for national resilience – energy, water, transport, telecommunications – the stakes of a single compromised individual are disproportionately powerful.

What can organisations do?

The first-order danger for organisations is the damage insiders can do; the second one is that the fear of insiders can infer as much har as the insiders themselves. Organisations that respond to ideological risk by surveilling employees, restricting communication, or treating political expression as a security threat tend to accelerate the very disengagement and distrust they are trying to prevent, ultimately conceding to the propaganda scheme.

The more productive response operates on three levels.

1. The first is awareness: understanding that employees are not passive consumers of the information environment, and that what is happening on social media feeds has real consequences for organisational cohesion and risk posture.

2. The second is culture: building the kind of institutional trust that makes employees less susceptible to narratives that somehow frame their employer as the enemy. Organisations whose staff believe they work somewhere with genuine values and honest leadership are harder to radicalise against.

3. The third is process: reviewing whether insider risk detection frameworks are calibrated for ideological motivation, and whether escalation pathways allow employees to anonymously raise their concerns about behavioural change without defaulting immediately to disciplinary action. In addition, effective reporting channels create space to let employees speak up about issues safely, without fears of repercussions, and feel heard about what they care about without needing to resort to more radical means.
   

Disclaimer: The cases discussed in this publication are based solely on publicly available information at the time of writing. They are intended for educational and illustrative purposes and should not be interpreted as definitive investigative findings. In some instances, official investigations may still be ongoing, and information may emerge that could alter the understanding of the events described. Signpost Six makes no claims regarding the actions, intentions, or liability of any individuals or organisations mentioned. While every effort has been made to ensure accuracy, Signpost Six accepts no responsibility for any errors, omissions, or misinterpretations arising from the use of publicly sourced information.