Hacktivist Groups’ Attacks Surge Amidst Israel-Iran War

Missile exchanges over the skies of Israel and Iran entered their eighth day, wreaking death and destruction. Hacktivists are taking that as their cue to join the fray, although whether their efforts function as anything more than psychological operations is unclear.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Security experts said a massive increase in online attacks tied to the conflict began almost immediately after Israel first struck military and nuclear program targets inside Iran on June 13. Hacktivist groups claim to have been defacing websites, launching distributed-denial-of-service attacks and leaking stolen data. Wiper and banking malware also appeared.

Experts track more than 70 hacktivist groups across the Middle East that appear to have launched attacks or intensified efforts since the hostilities commenced on June 13. More than 90% of these groups appear to be pro-Iranian, and have been “driven by a broad coalition of ideologically motivated actors, many of whom identify with pro-Palestinian, pro-Iranian or anti-Western narratives,” said threat intelligence firm Cyble. Many sectors in Israel – from government, defense and media, to telecom, finance and emergency services – are being targeted.

The rise in pro-Iranian attacks has come despite the country restricting domestic internet access, saying it was throttling bandwidth as part of a “temporary, targeted and controlled” effort to combat any covert Israeli activity inside its borders.

Groups targeting Israel have included Anonymous Guys, GhostSec, LulzSec Black, Dark Storm Team and Cyber Islamic Resistance. The pro-Palestinian group Handala, which has repeatedly targeted Israel since launching in late 2023, has lately also listed multiple Israeli organizations on its data-leak site, including major energy firms.

Hacking groups have been targeting Iran, including Anonymous Syria Hackers, Islamic Hacker Army and Predatory Sparrow, which may be state-sponsored.

The conflict also appears to have resulted in spillover, in the form of escalated hacktivist attacks against other Middle Eastern countries. Cyble said this includes the targeting of Egypt by Keymous+, Jordan by Arbian Ghosts, Pakistan by Red Eagle, Saudi Arabia by Yemen Cyber Army and United Arab Emirates by Unknown Cybers team.

On Monday, security researchers spotted wiper malware they’ve dubbed Anon-g Fox, based on that being found in the code comments. The malware is set to execute only if it detects that the underlying system is set to Israel Standard Time and Hebrew as its default language. “If those conditions are not present, it prevents execution with the error statement, ‘This program can only run in Israel’, thus suggesting a geopolitical motive, potentially linked to the ongoing Iran-Israel cyber conflict,” Cyble said.

The firm said it’s also seen versions of the Iranian remote access Trojan, aka Irata, which security researchers first spotted in 2022 – when it was impersonating an Arabic-language stock market app – that have been tweaked to ape official Iranian organizations.

“The malware has been observed impersonating government entities, including the Judicial System of the Islamic Republic of Iran and the Ministry of Economic Affairs and Finance,” the researchers said. “It targets over 50 banking and cryptocurrency applications, abusing the accessibility service to identify the targeted bank, steal bank account numbers and balances and harvest card data.”

Real-World Disruption Largely Unclear

As always with hacktivism – as seen in the Russia-Ukraine War since 2022 and last month when pro-Pakistan hackers targeted India – the real-world impact of many groups appears to be minimal. That doesn’t stop these operations from trumpeting the disruptions they’ve supposedly wrought.

Exceptions apply, including for attacks tied to the pro-Israel hacking group Gonjeshke Darande – Persian for Predatory Sparrow – which has repeatedly disrupted physical infrastructure, and which many security experts suspect is state-sponsored. On Tuesday, the group claimed to have destroyed the IT infrastructure for Iran’s largest financial service firm, Bank Sepah, leading to widespread online service and ATM disruptions. The group also leaked the account balances of customers, including government and other public figures.

Predatory Sparrow followed that with an attack against Iranian cryptocurrency exchange Nobitex, when it effectively burned cryptocurrency worth about $100 million, with some reports also suggesting 95% of the exchange’s $1.8 billion in assets may have been lost. The attackers also dumped the exchange’s source code, and suggested they would be targeting Tehran Stock Exchange and other critical infrastructure.

Potential Iranian Nation-State Reprisals

Whether state-backed Iranian hackers will soon join the fray by targeting Israel or its allies for reprisals remains unclear. Such hackers have previously caused significant disruption. The United States in 2016 indicted seven Iranians for launching damaging waves of DDoS attacks against American banks from late 2011 to mid-2013.

Much more recently, an Iranian state hacking group affiliated with the Islamic Revolutionary Guard Corps, called CyberAv3ngers, has targeted critical infrastructure in both Israel and the U.S. with IOControl malware, designed to infect operational technology and Internet of Things infrastructure (see: Researchers: Iranian Custom Malware Targets Fuel Systems).

The U.S. Rewards for Justice program is offering a reward of up to $10 million for information leading to the identification or location of anyone involved in directing or supporting malicious Iranian cyber operations, including as part of CyberAv3ngers.

One major takeaway from the Russia-Ukraine War has been how cyber has been used, and how it hasn’t been used. Despite predictions from some experts that Russia might use cyberattacks to blitz the Ukrainian data space, causing mass electrical and communications blackouts that never happened. Russia appears to have used cyber capabilities to augment some types of kinetic operations, although rarely if ever in real time. Moscow also appears to have been careful to not violate potential red lines, such as launching destructive attacks against American banks or other critical infrastructure.

As the Israel-Iran conflict continues, one open question remains if Tehran will task government hackers to carry out destructive cyberattacks remains to be seen.

Some experts think such a move is very unlikely.

“The regime is under existential threat,” Dmitri Alperovitch, chair of the Silverado Policy Accelerator think tank in Washington, told The Telegraph. “Iranian cyber is a toy.”