Hacktivist attacks against Israeli websites mirror attacks following Russian invasion of Ukraine

Hacktivists have launched hundreds of web defacement attacks against targets in Israel following the devastating attack by Hamas on Israeli civilians on 7 October 2023.

More than 100 hacktivists launched over 500 attacks on websites in Israel in the week following Hamas’ attack on party-goers attending a festival in Kibbutz Re’im, close to the Gaza border.

The Hamas incursion, which led to 1,300 deaths (at least 260 at the festival), was followed by a wave of defacement attacks on Israeli websites to show support for Gaza and Palestine, according to researchers at the University of Cambridge.

The hacking spree followed a similar pattern to the hacktivist attacks that followed the Russian invasion of Ukraine in 2022, researchers at Cambridge’s cyber crime centre found. The key difference is hacktivist attacks were one sided – focusing solely on Israeli targets, with virtually no attacks identified on Palestinian websites.

Professor of Security Engineering, Ross Anderson, at the University of Cambridge, one of the authors of the research, said there was little evidence that hacktivists were attacking Palestinian websites. “Israelis and Jewish people are so traumatised by what happened that defacing a Hamas website is an inappropriate response,” he said.

According to the Cambridge University researchers, hacktivists began targeting Israeli websites within hours of Hamas gunmen attacking thousands of young people attending a music festival at the Kibbutz. The number of defacement attacks peaked two days later following Israel’s declaration of war, and peaked again on 13 October. The hacking patterns were similar to attacks that followed Russia’s invasion of Ukraine in 2020.

The researchers found the number of attackers targeting Israeli websites built up following an initial surge of attacks before the number of attackers dropped off steadily, with only three hacktivists still active on 16 October. Offensive attacks against Israeli websites exceeded the number of hacktivist attacks against the Ukraine, but were less than the number of attacks against Russia, the researchers found.

“While the attacks targeted both sides in the Russia-Ukraine conflict, the Israel-Hamas war has been one-sided, with no significant attacks against Palestine thus far,” the researchers said.

The researchers found that website defacers were highly centralised, with the top 10 most active accounting for nearly 80% of the attacks. One hacktivist was responsible for over 20% of website defacements. Out of 530 defacement attacks against Israel analysed following the Hamas attack, more than 300 Israeli sites were defaced with messages supporting Palestine, with hashtags such as #opisarel, #freepalestine #savepalestine and #savegaza.

The proportion of attacks expressing support for one side in the Israeli-Hamas conflict is much higher than seen in the Russian-Ukraine war, where only 7% of attacks explicitly expressed support for one side.

There is little evidence of hacktivists attacking high-profile targets in Israel, the researchers found. Most of the attacks were directed against businesses. An Israeli housing association, a large public college in Israel, and a subdomain of the Israeli defence forces were also attacked. As with the Ukraine war, most of the defacement targets were strategically unimportant, the researchers found.

Anderson said there is a significant overlap between hacktivist communities and extremist communities, including alt-right groups. “One of the threads that goes through all those communities is antisemitism,” he added.

Most of the attacks appear to have been conducted by “script kiddies” that scan IP addresses and looking for relevant computers they can hack, he said, and they tend to lose interest after a week.

“Lots of people talk up the idea that hacktivist could make a big difference in combat. What we are seeing in both the Ukraine work and the work now in Hamas is that this is over-egged. You do see some civilian activism around war outbreaks but its so low grade as to be of no security concern,” he said.

The Jerusalem Post reported on October 9 that it had been targeted by a series of cyber attacks which had temporarily left its website inaccessible. Defacement attacks against Israel appear to be more persistent than those on Russia or Ukraine, but it is unclear when the attacks against Israel will tail off, a research report found.