New Cyber Directorate Report Shows Rise in Cyber Attacks Against Israel Since War Began
During the past two months, approximately 15 major cyber-attack groups were identified, some of which share intelligence. These groups are attributed to Iran, Hamas, and Hezbollah
Cybertech
| 25/12/2023
The Israel National Cyber Directorate published a new report summarizing the nature of cyber activity against Israel since the beginning of the war, asserting that it has steadily intensified during this period.
While at the outset of the war, the attacks were simple and unsophisticated, comprising mainly of website defacements and mainly for visible purposes, over time they have become more focused and aimed at causing tangible disruption to organizations, creating a broad impact by targeting companies considered part of the supply chain for many organizations.
The report concludes that the attackers' activity has escalated gradually throughout the war, and currently focuses on attacks to cause disruption and damage. In the past, the focus was more on attacks for espionage and data theft.
The report examines the techniques and tactics employed during the war, and asserts that similarities can be observed with techniques used in other events worldwide, such as the Ukraine-Russia war. It highlights two main aspects: the use of psychological warfare as a means to raise awareness of cyber-attacks and the utilization of social networks. Additionally, it notes the use of destructive tools, such as wipers – malicious software designed to erase information from computers.
The report details the main focus of attacks and attempted attacks in a broad range of activities, including widespread disinformation campaigns, service disruption attacks, penetration attempts for obtaining leaked information or deletion, activities targeting LINUX systems, attempts to compromise security cameras, phishing attacks, attempts to disrupt the operation of specific phone applications, and attacks on organizations that serve as significant parts of the economy’s supply chain.
Additionally, the researchers noted attempts to influence social networks through the dissemination of fake news, disinformation, manipulated information recycling of old materials presented as new, and calls for attackers to join various campaigns.
According to the report, during this period, approximately 15 major cyber-attack groups were identified, some of which share intelligence. These groups are attributed to Iran, Hamas, and Hezbollah.
The main sectors targeted by the attacks are the IT sector, including web hosting and site storage companies; the healthcare sector; academia; transportation; maritime shipping; customs activities; and energy and fuel supply. The common denominator of targeting these organizations is the potential for widespread impact on other organizations within the sector or those relying on the services of the targeted organization.
In addition, the report notes an increase in the frequency of ransomware incidents against Israel. The choice of ransomware as an attack tool is not surprising and is even natural at this time. Ransomware is a significant threat in the cyber arena, and the deterrent and chaotic effect following a ransomware attack achieves its goal.
The report also details the activity of the Cyber Directorate since the beginning of the war in developing technological tools and methods that enabled the detection of dozens of campaigns for financing terrorism worth millions of dollars.
Read the full report (currently available in Hebrew)
During the past two months, approximately 15 major cyber-attack groups were identified, some of which share intelligence. These groups are attributed to Iran, Hamas, and Hezbollah
The Israel National Cyber Directorate published a new report summarizing the nature of cyber activity against Israel since the beginning of the war, asserting that it has steadily intensified during this period.
While at the outset of the war, the attacks were simple and unsophisticated, comprising mainly of website defacements and mainly for visible purposes, over time they have become more focused and aimed at causing tangible disruption to organizations, creating a broad impact by targeting companies considered part of the supply chain for many organizations.
The report concludes that the attackers' activity has escalated gradually throughout the war, and currently focuses on attacks to cause disruption and damage. In the past, the focus was more on attacks for espionage and data theft.
The report examines the techniques and tactics employed during the war, and asserts that similarities can be observed with techniques used in other events worldwide, such as the Ukraine-Russia war. It highlights two main aspects: the use of psychological warfare as a means to raise awareness of cyber-attacks and the utilization of social networks. Additionally, it notes the use of destructive tools, such as wipers – malicious software designed to erase information from computers.
The report details the main focus of attacks and attempted attacks in a broad range of activities, including widespread disinformation campaigns, service disruption attacks, penetration attempts for obtaining leaked information or deletion, activities targeting LINUX systems, attempts to compromise security cameras, phishing attacks, attempts to disrupt the operation of specific phone applications, and attacks on organizations that serve as significant parts of the economy’s supply chain.
Additionally, the researchers noted attempts to influence social networks through the dissemination of fake news, disinformation, manipulated information recycling of old materials presented as new, and calls for attackers to join various campaigns.
According to the report, during this period, approximately 15 major cyber-attack groups were identified, some of which share intelligence. These groups are attributed to Iran, Hamas, and Hezbollah.
The main sectors targeted by the attacks are the IT sector, including web hosting and site storage companies; the healthcare sector; academia; transportation; maritime shipping; customs activities; and energy and fuel supply. The common denominator of targeting these organizations is the potential for widespread impact on other organizations within the sector or those relying on the services of the targeted organization.
In addition, the report notes an increase in the frequency of ransomware incidents against Israel. The choice of ransomware as an attack tool is not surprising and is even natural at this time. Ransomware is a significant threat in the cyber arena, and the deterrent and chaotic effect following a ransomware attack achieves its goal.
The report also details the activity of the Cyber Directorate since the beginning of the war in developing technological tools and methods that enabled the detection of dozens of campaigns for financing terrorism worth millions of dollars.
Read the full report (currently available in Hebrew)
