Six Months of Cyber and Hybrid Activity Amid the Israel-Hamas Conflict
Summary
DarkOwl reviews cyber and hybrid activity tied to the conflict, including hacktivist attack claims, reported damage to undersea cables, and an attempt to misdirect an El Al flight. Some claims and attributions remain uncertain.
Key points
- Hacktivist groups including Killnet, Anonymous Sudan, and Garuna Ops publicly took sides and claimed or threatened attacks.
- Anonymous Sudan claimed attacks on Israeli telecom company Pelephone, Bazan Group, and healthcare infrastructure; the article does not independently verify these claims.
- A ransomware attack on Israel-based Navitas Petroleum was reported as purported; the article says the company was not listed on BlackBasta’s victim blog and the claim may have been fabricated or resolved privately.
- The article reports that undersea cables carrying about 17% of international data were damaged in the Red Sea, but notes uncertainty over whether Houthi activity or ships sinking caused the damage.
- Media reported an attempt to reroute an El Al flight using misleading instructions; the crew checked with other air traffic controllers and stayed on course.
- The review describes cyber activity, online propaganda, and physical threats to infrastructure as interconnected elements of the conflict.
Article Details
- Event Type
- Six-month review of cyber and hybrid incidents associated with the Israel-Hamas conflict, including claimed cyberattacks, threats against organizations and infrastructure, and an attempted disruption of an Israeli airliner’s route.
- Impact
- Reported and claimed activity affected or threatened organizations and infrastructure in Israel, Iran, and the wider region. Examples include attacks or claims involving fuel stations, telecommunications, healthcare, air-force servers, and defense contractors. Undersea cables in the Red Sea were damaged, though responsibility was disputed; an attempt to mislead an El Al flight crew about its route was unsuccessful.
Threat Actors
Anonymous SudanClaimed attacks against Israeli organizations and healthcare infrastructure; the article reports these as claims.BlackBastaRansomware actors were purportedly reported to have hit Navitas Petroleum; the article says the claim may have been fabricated or the victim’s data removed from the group’s victim blog.Garuna OpsPosted support for Israel and stated it would attack Palestine and other countries supporting Palestine.KillnetPosted an intention to target the Israeli government on Telegram.Predatory SparrowPublicized an attack on Iranian fuel stations; the article reports the group claimed to have attacked 70% of them.
Malware
Products
8kunDarkOwl analysts have observed multiple platforms, including Discord, onion websites, and 8kun, sharing information regarding the hostile situation in the Red Sea:DiscordDarkOwl analysts have observed multiple platforms, including Discord, onion websites, and 8kun, sharing information regarding the hostile situation in the Red Sea:TelegramTelegram remains a vital part of the conflict, with propaganda emerging from Iranian, Arabic, and Israeli Telegram channels, as well as sympathizers and opponents from all sides of the conflict taking a public stance
Countries
IranIran issued a statement that the October 07 attack against Israel was in retaliation for the January 2020 assassination of IRGC commander Qassem Soleimani (December, 2023)IsraelA new Middle East conflict emerged on October 7, 2023, when Hamas launched an attack on Israel.PalestineIt rages on to the present day, resulting in physical, digital, and hybrid events that threaten both Israel and Palestine and their borders with multiple surrounding countries.ThailandThe original flight path was from Bangkok, Thailand, and Tel Aviv, Israel.United StatesMaritime activity in the Red Sea also involved the United States conducting a cyberattack on an Iranian ship that had been gathering intelligence on cargo vessels in the region.YemenThis was intended to prevent the ship from sharing intelligence with Houthi members in Yemen, who have been frequently targeting civilian vessels.
Industries
DefenseHowever, Raytheon and other US defense contractors are frequently targeted by Russian groups, such as this Snatch Ransomware group observation which also came in March 2024:HealthcareAnonymous Sudan also claimed it conducted a cyberattack targeting “critical parts” of healthcare infrastructure in Israel, and adds “more than a thousand devices are completely disconnected.”MaritimeIn the past six months, some of the trending issues the world has witnessed include drastic upticks in maritime and ground-centered activity against Iranian-supported actors, such as the Houthis and Hezbollah.PetroleumNavitas Petroleum, based in Israel, was purportedly hit by BlackBasta ransomware (December, 2023)