Cyber ops linked to Israel-Hamas conflict largely improvised, researchers say

Microsoft and Mandiant researchers believe Iranian hackers were not prepared for the initial Hamas attack.

In the wake of Hamas’s attack on Israel, researchers and cybersecurity firms observed an uptick in operations by hacktivists and state-sponsored hacking groups. But more than one month into the conflict, researchers are increasingly concluding that cyberoperations linked to the war have been mostly opportunistic in nature and frequently exaggerated in terms of their impact. 

In a pair of reports presented Thursday at the CYBERWARCON computer security conference in Arlington, Va., researchers from Microsoft and Mandiant, the Google-owned cybersecurity firm, described a wide range of cyber operations, ranging from influence operations to ransomware attacks that have attempted to shape the conflict between Israel and Hamas.

Shortly after Hamas fighters crossed into Israel, for example, researchers from the two firms said that Telegram channels were spun up to disseminate videos of massacres carried out at kibbutzim along the Gaza border. Pro-Iran mass media picked up on these videos and amplified them, while a number of different hacktivist groups claimed to have breached various Israeli critical infrastructure entities, in what appear to be exaggerated claims of cyberattacks. 

Taken together, the cyber operations around the conflict point toward an improvised effort. “We have no evidence that Iranian threat actors were actually prepared for the attack,” said Simeon Kakpovi, a senior threat intelligence analyst at Microsoft.

Having been caught flat-footed by the Hamas attack, Iranian hacking groups instead used their existing operations and access to compromised systems and tried to pivot these operations to support Hamas, Kakpovi said.  

Microsoft did not observe Iranian-linked cyber activity until Oct. 18, roughly 11 days after the start of the ground conflict. Data collected by Microsoft on known Iranian-linked hacking groups provides no evidence that the groups had pre-planned cyberattacks aligned with Hamas’s Oct. 7 attack, the researchers said, bolstering claims from senior U.S. government officials that Iran was likely not directly involved in the planning and execution of the attack.

As they spun up operations, the Iranian-linked groups made exaggerated claims regarding the impacts of their operations, including a purported ransomware attack on an Israeli military facility by a group known as Soldiers of Solomon, which is linked to Iran’s Islamic Revolutionary Guard Corps. That attack included claims of massive data exfiltration and screenshots of internet-connected cameras near the facility.

The compromised cameras, according to the researchers, were actually located across scattered sites outside any one defined region, suggesting “that despite Iran actors’ strategic claims, this camera example was ultimately a case of adversaries continuing to opportunistically discover and compromise vulnerable connected devices and try to reframe this routine work as more impactful in the context of the current conflict.”

While it is unclear how attacks on internet-connected cameras have figured into Hamas’s military operations, Israeli authorities nonetheless appear to be concerned about the risk they pose, including as possible targeting aids for rocket attacks. Israeli national security agencies reportedly want greater access to domestic cameras, including the ability to hack into them. 

Researchers caution that as the conflict between Israel and Hamas drags on, attacks in the digital arena may ramp up. The relatively low-level cyber operations observed in the conflict so far are reflective of its participants’ political calculations, which may change as time goes on. 

“Iran did not in earnest join the war yet, so it is plausible that in cybersecurity they are also walking the line,” said Yuri Rozhansky, a Google researcher studying the conflict.

The cybersecurity firm Crowdstrike reported on Thursday that a hacking group known as Charming Kitten, which is linked to the IRGC, has targeted the transportation, logistics and technology sectors with novel malware. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure