Hamas attacks on Israel: cyber reflections

The Hamas attacks on Israel have led certain hacking groups and their members to announce political stances and provide statements of intent, similar in their nature to those seen amongst hacking groups at the outset of the ongoing conflict in Ukraine.

• Russia-aligned cybercriminal group Killnet have announced their opposition to “the Government of Israel, not citizens”, according to a public statement, noting that this was due to their support of “the terrorist regime of Ukraine”.
• Killnet’s leader recently stated that the group was now a “Russian private military hacker company” and not a hacktivist organisation, and that they would abide by The International Committee of the Red Cross (ICRC)'s “rules of engagement” for civilian hackers operating in conflict zones.
• The ICRC’s rules of engagement most notably advocate avoiding attacks on civilian, medical, and humanitarian facilities and infrastructure.
• Killnet’s statement was strikingly anti-NATO and anti-Europe, in keeping with its alignment to Russian geopolitical objectives and narrative:

?“If we oppose the Israeli government, this does not mean that we are going against ordinary citizens of this country. The Israeli regime sold itself to the NATO [expletive], the same main terrorist, with the slogan of PEACE and DEFENSE! The atrocities that Hamas or Israel commit against civilians are terrible! We exclude the possibility of attacking the critical infrastructure of both sides! Our goal is the pro-NATO government of Israel (believe me, there are not many of them left anymore)! ?Our brothers and sisters are all civilians and peaceful residents of Israel! ?We call on you to stop the bloodshed on both sides! If you want war, there are thousands of kilometers of emptiness around you, fight there. Civilians of Gaza and Israel do not have the right to give their lives for the sake of [expletive] from Europe”.

• Anonymous Sudan, a cybercrime collective suspected by many to be Russia-backed, are believed to have joined forces with Killnet and have announced a “call to arms”. Shortly after the commencement of the attacks, Anonymous Sudan are believed to have taken down emergency alerting systems, using denial-of-service techniques.
• GhostSec, a self-described "vigilante" group, commented that the attacks were "a huge victory for the people of Palestine", they were "proud of all of the fighters", and "we at GhostSec stand with you all".
• Iran-aligned Cyber Av3ngers have also been conducting cyberattacks on Israel, claiming to have compromised the DORAD Power Plant and leaking related documents.
• According to a member of the unaligned group ThreatSec, they were going to attack "the Gaza region" under a general anti-war stance, further claiming to have shut down over 5,000 servers operated by Alfanet - one of the largest ISPs in the region - cutting off Internet access and TV broadcasts.

Opportunistic searches on hacking databases for vulnerabilities associated with web domains ending .ps or .il have increased substantially since the attacks, as have requests for related information. These requests have included academic and educational institutions, alongside private sector businesses and Government organisations in both Israel and Palestine.

Administrators for criminal hacking resources have repeatedly discouraged their users and members from religious or political activity.

Anyone operating a .ps or .il domain is advised to conduct a cybersecurity review, including an assessment of ‘dark web’ materials that may be available to hackers.

Hacking groups on both sides are likely to be actively monitoring for businesses that take a political stance and are likely to consider any political statements as justification for targeting those businesses with cyberattacks.

Other hacking groups are likely to use the situation to obfuscate their actions, motivations, and intentions.