Hacktivist Groups Claim Attacks on Israeli and Palestinian Targets Amid Conflict
Summary
DarkOwl reported that groups took sides and claimed DDoS attacks, defacements and data leaks amid the Israel-Hamas conflict. The researchers said many claims were unverified, and the Red Alert app manager denied claims it was down.
Key points
- DarkOwl identified several groups taking sides, including Killnet, Anonymous Sudan, GhostSec, Cyb3r Drag0nz and Garuna Ops.
- Anonymous Sudan and GhostAnon claimed to have taken down Israel’s Red Alert app; the app manager denied the claims, and the groups provided no concrete proof.
- The Jerusalem Post said it was experiencing a major cyberattack after Anonymous Sudan claimed a successful DDoS attack.
- Cyb3r Drag0nz claimed website defacements and said it obtained data from more than 100,000 Israeli Instagram accounts; DarkOwl said the information was unverified.
- Cyber Av3ngers claimed attacks on Israeli energy targets and the theft of sensitive information; Israel had previously denied the group’s claim of an attack on a public railroad.
- DarkOwl reported claims of doxxing and exposure of purported Iron Dome IP addresses, which it said were unverified and redacted.
- DarkOwl assessed that the activity observed so far was not highly sophisticated but could be disruptive; it noted that government sources had reported no evidence of cyberattacks.
Article Details
- Event Type
- Hacktivist groups reported launching or claiming cyberattacks in connection with the Israel-Hamas conflict.
- Impact
- Groups claimed DDoS attacks, website defacements, and theft or disclosure of information involving Israeli organizations and individuals. DarkOwl did not verify the reported attacks; the Red Alert app's manager refuted claims that it was down, and Israel denied an earlier claimed attack on a public railroad. The Jerusalem Post reported a major cyberattack and remained unavailable for several hours.
MITRE ATT&CK
T1491 · DefacementCyb3r Drag0nz claimed to have defaced Israeli websites.T1498 · Network Denial of ServiceGroups claimed to conduct DDoS attacks against the Red Alert system, The Jerusalem Post, the Mossad open website, and Dorad Power station; success was not verified in all cases.T1567 · Exfiltration Over Web ServiceCyb3r Drag0nz claimed to have released a download containing data from more than 100,000 Israeli Instagram accounts; the claim was unverified.T1589 · Gather Victim Identity InformationGroups allegedly disclosed personal information about Israeli citizens and officials, including a purported name and phone number.
Threat Actors
Anonymous SudanClaimed a DDoS attack against the Red Alert app and claimed to have successfully DDoSed The Jerusalem Post.Cyb3r Drag0nzExpressed support for Palestine and claimed website defacements and theft of Israeli Instagram account data.GhostSecIdentified as one of the groups expressing support for Palestine/Hamas.KillnetPosted an intention to target the Israeli government.SiegedSecIdentified as one of the groups expressing support for Palestine/Hamas.
Products
Countries
Industries
Electricityof Iran, activities preceded the invasion and began on October 6 when they targeted Noga Company, an electricity company claiming they were causing power outages “due to the actions of your [Israel] government.” intelligenceAlthough this is the open site and therefore unlikely to hold any sensitive information its likely aim was to cause distraction to the Israeli Intelligence services.MediaThis has led to a huge number of posts, images and videos being shared of the incursion and atrocities on social media but also on the dark web and dark web adjacent sites.RailroadIt is worth noting this group had previously claimed responsibility for attacking an Israeli public railroad in mid-September.