‘Hacktivists’ join the front lines in Israel-Hamas war

WASHINGTON and JERUSALEM — When Hamas sprung its deadly assault on Israel in early October, its militants came from land, air and sea.

The Palestinian group launched rockets at populous areas, deployed drones to destroy observation posts , used motorized gliders to float fighters over fortified borders and dispatched speedboats into defended waters. The effects were instantly tangible, with many Israelis killed, abducted or displaced. Infrastructure, including hardened military installations, was damaged.

Less apparent were the virtual campaigns waged before, during and after the opening salvos, though not necessarily by Hamas itself. Hackers supporting its cause hijacked billboards and flooded phones with threatening texts. Grisly videos quickly circulated online, and social media platforms such as X, formerly Twitter, were saturated with front-line footage, some of it fake .

The online efforts serve many purposes, experts told C4ISRNET, including influencing public opinion, softening resistance and hampering the emergency response.

Cyberattacks “are increasing daily, with hundreds of attacks we’ve monitored so far,” said Gil Messing, the chief of staff at Check Point Software Technologies , a cybersecurity company with roots in Tel Aviv. “Our data shows an 18% increase in attacks on Israeli targets since the beginning of the war, and we expect it to continue.”

Outside groups with vested interests in the Israel-Hamas fight are dominating the cyber battlefield.

Operations include defacing popular websites and flooding networks with artificial traffic, rendering them unable to function. This tactic is known as a distributed denial-of-service, or DDoS, attack. Similar moves were seen in the opening days of the Russia-Ukraine war .

“Cyberattacks happened all along, before the [Hamas attack] and after,” said Messing, whose team monitors dozens of third-party groups around the world.

“Hacktivists play a critical role here and actually carry out the vast majority of attacks,” Messing added, using a term for hackers motivated by political or social movements.

Cloudflare, an American company that provides cybersecurity and network services, said media sites were prime targets in the wake of the Oct. 7 Hamas incursion. For example, the Jerusalem Post was knocked out Oct. 9 . The outlet boasts millions of monthly visitors and bills itself as the No. 1 English-language website covering Israel.

Other targets included the computer software industry, financial sectors and government services.

The exterior of Israel's cyber training center in Beersheba. (Courtesy of the Israel Defense Forces)

“Before Oct. 7, there were barely any HTTP DDoS attack requests towards Israeli websites using Cloudflare,” the company said in a blog post . “However, on the day of the Hamas attack, the percentage of DDoS attack traffic increased. Nearly 1 out of every 100 requests towards Israeli websites using Cloudflare were part of an HTTP DDoS attack. That figure quadrupled on Oct. 8.”

Such attacks are relatively unsophisticated and have little consequence on national security operations, experts said. While a vandalized website can disconcert the public, it likely does not sidetrack military operations.

As a result, pinning the importance of the cyber domain in the Israel-Hamas fight has thus far proved tricky, according to Annie Fixler, the director of the Center on Cyber and Technology Innovation at the Washington-based Foundation for Defense of Democracies .

“It is a moving target because we’ve seen a lot of activity, we’ve seen ramp-ups of activity. Deciphering the level of significance of that activity, I would say, is an ongoing challenge,” she told C4ISRNET. “There are a lot of hacktivist groups that are going to claim to have had an operational impact, when what they really did was DDoS a website or deface a website.”

Israel is regarded as well-versed in cyber warfare, wielding capabilities that rival the virtual arsenals of much larger powers. Officials years ago recognized cyber as an emerging field that could lend the country — stuck in a “bad neighborhood,” as Israeli officials and outside analysts describe it — a distinct advantage .

Elite divisions have since cropped up, such as the Israel Defense Forces’ Unit 8200, which specializes in intelligence gathering and cyberspace operations. The unit has been likened to the U.S. National Security Agency or the U.K. Government Communications Headquarters.

“Generally speaking, Israeli offensive cyber capabilities are sort of second to the United States ,” Fixler said. “Our general sense is that the Israelis have the capabilities they need. There is not a significant capability that we could provide to them that they do not already have themselves.”

The U.S. in October said it was rushing cyber support to Israel but declined to provide specifics. The U.S. Cybersecurity and Infrastructure Security Agency is coordinating with the Israel National Cyber Directorate, according to Brandon Wales, the executive director at CISA.

Furthermore, U.S. Defense Secretary Lloyd Austin is said to have held daily calls with his Israeli counterpart, Yoav Gallant.

Kate Fazzini, a cybersecurity professor at Georgetown University, described Israel as a leader in the cyber domain , one capable of digitally outgunning Hamas.

“They are far more sophisticated than their population size,” she said. “I would say the sophistication is certainly on par with the United States.”

A report published by the London-based International Institute for Strategic Studies think tank in 2021 and updated this year put the U.S. atop the cyber-power hierarchy. China, Russia and Israel were among those placed one rung below, in a second tier.

A separate report posted by the Washington-based Atlantic Council think tank described Hamas’ cyber capabilities as nascent and “lacking the sophisticated tools of other hacking groups,” but not to be underestimated.

Amid the Israel-Hamas war, officials are watching for signs of regional aggravation or wider escalation. Experts interviewed by C4ISRNET said they have their eyes on Iran, Russia and the Lebanon-based militant group Hezbollah.

Wanton cyber activity could intensify the already bloody battle, with reports of thousands killed.

“The one way that cyber would make a huge difference is if it bleeds into the kinetic landscape — if either side is able to turn off water, able to make any kind of changes to the electric grid,” Fazzini said. “Is a larger power capable, like Iran, of waging a cyberattack in Gaza to make Israel look worse? I think that’s also a possibility.”

Palestinians inspect the rubble around the Ahmed Yassin mosque, which was destroyed by Israeli airstrikes, in Gaza City on Oct. 9, 2023. (Adel Hana/AP)

Iran in 2020 was linked to a cyberattack that aimed to disrupt water supplies in Israel. The attack was detected and defeated, and the water authority later hired a cybersecurity firm to beef up its defenses, the Times of Israel reported.

“If you have that cyber-to-kinetic connection,” Fazzini said, “I think that’s the main issue.”

U.S. cyber specialists spent three months in Albania this year, attempting to expose hacking tools in the wake of Iranian cyberattacks on government systems. The attacks on the smaller NATO ally forced key services offline, including the Total Information Management System, which tracks details of those entering and exiting the country.

Both Messing, of Check Point Software Technologies, and Refael Franco, the former deputy chief of the Israel National Cyber Directorate, said Iranian-aligned cyber groups pose a real threat to Israel. Franco took it a step further, saying the groups “are still working against Israeli critical infrastructure and vital assets.”

Besieging critical infrastructure , such as the communications, energy, health care, and food and agriculture sectors, could inflict widespread damage.

“Israel must be ready to operate ‘Plan B,’ ” Franco said, and execute an “ASAP response if there is a cyberattack.”

Colin Demarest was a reporter at C4ISRNET, where he covered military networks, cyber and IT. Colin had previously covered the Department of Energy and its National Nuclear Security Administration — namely Cold War cleanup and nuclear weapons development — for a daily newspaper in South Carolina. Colin is also an award-winning photographer.

Tzally Greenberg is the Israel correspondent for Defense News. He has experience reporting on economic affairs as well as defense and cyber companies.

华盛顿和耶路撒冷——10月初，哈马斯对以色列发动致命袭击时，其武装分子从陆地、空中和海上发起进攻。

巴勒斯坦武装组织向人口稠密地区发射火箭弹，部署无人机摧毁观察哨，使用滑翔机将武装人员送过设防边界，并派遣快艇进入防御水域。这些行动的后果立竿见影，许多以色列人被杀、被绑架或流离失所。包括坚固军事设施在内的基础设施遭到破坏。

不太为人所知的是，在冲突爆发前后，尽管并非哈马斯自身所为，也开展了一系列网络宣传活动。支持哈马斯的黑客劫持了广告牌，并向手机发送了大量威胁短信。令人毛骨悚然的视频迅速在网络上传播，而像X（前身为Twitter）这样的社交媒体平台也充斥着各种前线画面，其中一些是伪造的。

专家告诉 C4ISRNET，这些网络活动有很多目的，包括影响公众舆论、削弱阻力以及阻碍应急响应。

“网络攻击每天都在增加，我们迄今已监测到数百起攻击，”总部位于特拉维夫的网络安全公司Check Point Software Technologies的首席运营官吉尔·梅辛表示。“我们的数据显示，自战争开始以来，针对以色列目标的攻击增加了18%，我们预计这种情况还会持续下去。”

在以色列与哈马斯的冲突中拥有既得利益的外部团体正在主导网络战场。

这些行动包括篡改热门网站，以及用虚假流量淹没网络，使其无法正常运行。这种策略被称为分布式拒绝服务（DDoS）攻击。在俄乌战争初期也出现了类似的行动。

“网络攻击一直都在发生，在（哈马斯攻击）之前和之后都是如此，”梅辛说道，他的团队监控着世界各地数十个第三方组织。

梅辛补充说：“黑客行动主义者在这里扮演着至关重要的角色，他们实际上实施了绝大多数的攻击。”他用这个词来指代受政治或社会运动驱使的黑客。

美国网络安全和网络服务提供商Cloudflare表示，在10月7日哈马斯入侵以色列后，媒体网站成为主要攻击目标。例如，《耶路撒冷邮报》于10月9日瘫痪。该媒体每月访问量达数百万，并自诩为报道以色列新闻的排名第一的英文网站。

其他目标还包括计算机软件行业、金融部门和政府服务部门。

以色列位于贝尔谢巴的网络训练中心外观。（图片由以色列国防军提供）

“10月7日之前，几乎没有针对使用Cloudflare的以色列网站的HTTP DDoS攻击请求，”该公司在一篇博客文章中表示。“然而，在哈马斯发动攻击当天，DDoS攻击流量的比例激增。每100个针对使用Cloudflare的以色列网站的请求中，就有近1个是HTTP DDoS攻击。10月8日，这一数字翻了四倍。”

专家表示，此类攻击相对简单，对国家安全行动影响甚微。虽然网站遭到破坏可能会引起公众不安，但不太可能干扰军事行动。

因此，据位于华盛顿的保卫民主基金会网络与技术创新中心主任安妮·菲克斯勒称，到目前为止，确定网络领域在以色列与哈马斯斗争中的重要性已被证明是棘手的。

“情况瞬息万变，因为我们看到了很多活动，而且活动还在不断增加。我认为，解读这些活动的意义程度始终是一个挑战，”她告诉C4ISRNET。“很多黑客组织会声称自己造成了实际影响，而实际上他们只是对网站发起了DDoS攻击或篡改了网站。”

以色列被认为精通网络战，其网络能力足以与许多国力更强的国家的网络武库相媲美。多年前，以色列官员就已意识到网络战是一个新兴领域，可以为这个被以色列官员和外部分析人士形容为身处“危险地带”的国家带来独特的优势。

此后涌现出许多精锐部队，例如以色列国防军的8200部队，该部队专门从事情报收集和网络空间作战。这支部队被比作美国国家安全局或英国政府通信总部。

“总的来说，以色列的网络进攻能力略逊于美国，”菲克斯勒说。“我们普遍认为，以色列已经拥有他们所需的能力。我们无法向他们提供他们自身不具备的重大能力。”

美国在10月份表示正在紧急向以色列提供网络安全支持，但拒绝透露具体细节。据美国网络安全和基础设施安全局（CISA）执行主任布兰登·威尔士称，CISA正在与以色列国家网络安全局协调合作。

此外，据说美国国防部长劳埃德·奥斯汀每天都与以色列国防部长约阿夫·加兰特通电话。

乔治城大学网络安全教授凯特·法齐尼将以色列描述为网络领域的领导者，有能力在数字领域击败哈马斯。

“他们的文明程度远超其人口规模，”她说。“我认为他们的文明程度绝对可以与美国相媲美。”

总部位于伦敦的国际战略研究所 (ISS) 于 2021 年发布的一份报告（今年进行了更新）将美国列为网络力量等级榜首。中国、俄罗斯和以色列等国则位列第二梯队。

华盛顿智库大西洋理事会发布的一份独立报告称，哈马斯的网络能力尚处于起步阶段，“缺乏其他黑客组织所拥有的复杂工具”，但不可低估。

在以色列与哈马斯交战之际，官员们正密切关注地区局势恶化或升级的迹象。C4ISRNET采访的专家表示，他们正密切关注伊朗、俄罗斯和黎巴嫩真主党武装组织的动向。

肆意妄为的网络活动可能会加剧这场已经血腥的战斗，据报道已有数千人丧生。

法齐尼说：“网络战真正能产生巨大影响的方式之一，是它与实战交锋——如果任何一方能够切断水源，或者对电网进行任何形式的改动。像伊朗这样的大国是否有能力在加沙发动网络攻击，让以色列的处境更加糟糕？我认为这也是一种可能性。”

2023年10月9日，巴勒斯坦人在加沙城查看被以色列空袭摧毁的艾哈迈德·亚辛清真寺周围的废墟。（Adel Hana/AP）

据《以色列时报》报道，2020年，伊朗被指与一起旨在破坏以色列供水的网络攻击有关。该攻击被发现并挫败，以色列水务部门随后聘请了一家网络安全公司加强其防御措施。

“如果你有网络与实体之间的联系，”法齐尼说，“我认为这就是主要问题。”

今年，美国网络专家在阿尔巴尼亚驻扎了三个月，试图查明伊朗针对该国政府系统发动网络攻击后使用的黑客工具。这些攻击迫使这个北约盟国的关键服务瘫痪，其中包括负责追踪出入境人员信息的“全面信息管理系统”。

Check Point软件技术公司的梅辛和以色列国家网络局前副局长拉斐尔·弗朗哥都表示，与伊朗结盟的网络组织对以色列构成真正的威胁。弗朗哥更进一步指出，这些组织“仍在攻击以色列的关键基础设施和重要资产”。

围攻通信、能源、医疗保健、食品和农业等关键基础设施可能会造成大范围破坏。

弗朗哥说：“以色列必须做好启动‘B计划’的准备，并在遭受网络攻击时尽快做出响应。”

科林·德马雷斯特曾是C4ISRNET的记者，负责报道军事网络、网络安全和信息技术方面的新闻。此前，他曾为南卡罗来纳州的一家日报报道美国能源部及其下属的国家核安全管理局，主要关注冷战后的清理工作和核武器研发。科林还是一位屡获殊荣的摄影师。

扎利·格林伯格是《防务新闻》的以色列记者。他拥有丰富的经济事务以及国防和网络安全公司报道经验。