Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative

 

In the wake of the Israel-Hamas conflict that erupted in October 2023, hackers affiliated with Iran and Hezbollah orchestrated a series of cyber attacks aimed at influencing public opinion and undercutting support for Israel. These attacks, ranging from phishing campaigns to destructive malware deployments, highlight the evolving nature of cyber warfare in modern conflicts.

The Role of Cyber Attacks in Modern Warfare

Cyber attacks have become a critical component of modern warfare, allowing adversaries to engage in clandestine operations without direct military confrontation. These attacks can be quickly deployed at a lower cost, making them an attractive option for state-sponsored groups seeking to influence regional conflicts.

Iran's Phishing Campaigns

Iranian-backed hackers accounted for nearly 80% of all government-backed phishing activity targeting Israel in the lead-up to the October attacks. These campaigns were designed to steal intelligence and turn public opinion against Israel, showcasing Iran's use of cyber operations as a strategic tool in the conflict.

Hezbollah's Hack-and-Leak Operations

Hezbollah hackers, operating independently of kinetic actions, engaged in hack-and-leak operations targeting entities in Israel and the U.S. These operations aimed to undermine key Israeli organizations and sway public opinion against Israel, showcasing Hezbollah's cyber capabilities.

Iran's Cyber Operations

GREATRIFT's Malware Propagation

The Iran-affiliated group GREATRIFT propagated malware through fake "missing persons" sites and blood donation-themed lure documents. These tactics were aimed at targeting visitors seeking updates on abducted Israelis, highlighting the group's use of deceptive techniques in cyber operations.

Hacktivist Personas' Destructive Attacks

Hacktivist personas such as Karma and Handala Hack leveraged wiper malware strains to stage destructive attacks against Israel. These attacks aimed to delete files from Windows and Linux systems, showcasing the destructive potential of cyber operations in modern conflicts.

Charming Kitten's Phishing Campaigns

The Iranian nation-state hacking group Charming Kitten targeted media and NGOs with a PowerShell backdoor as part of a phishing campaign. This highlights Iran's use of sophisticated phishing techniques to target organizations critical of its actions.

Hamas' Cyber Operations

Targeting Israeli Software Engineers

Hamas-linked groups targeted Israeli software engineers with coding assignment decoys, attempting to trick them into downloading SysJoker malware. This campaign, attributed to the threat actor BLACKATOM, showcases Hamas' use of social engineering tactics in cyber attacks.

Use of Spyware on Android Phones

Hamas-affiliated actors deployed spyware targeting Android phones to harvest sensitive information. Malware strains such as MOAAZDROID and LOVELYDROID, developed by the actor DESERTVARNISH, highlight Hamas' use of advanced cyber tools in the conflict.

Impact on Iran's Critical Infrastructure

Iran's critical infrastructure was disrupted by an actor named Gonjeshke Darande, believed to be linked to the Israeli Military Intelligence Directorate. This highlights the interconnected nature of cyber warfare and its impact on regional conflicts.

Conclusion

The cyber attacks launched by Iran and Hezbollah during the Israel-Hamas conflict underscore the evolving nature of modern warfare. These attacks, ranging from phishing campaigns to destructive malware deployments, highlight the use of cyber operations as a strategic tool in influencing public opinion and undercutting adversaries. As cyber warfare continues to evolve, it is crucial for nations to enhance their cybersecurity capabilities to defend against such threats.