COLLABORATION | Cyber Operations in the Israel-Hamas Conflict

Considering the conflict in Ukraine and the more recent one between Israel and Hamas, it has become evident that cyberspace is a domain that has solidified as a stable element supporting operations. Furthermore, it allows the participation of anonymous groups operating from various geographical locations, thereby globalizing conflicts, no matter how localized they may seem.

On the morning of Saturday, October 7, just 12 minutes after Hamas initiated its military incursion against several cities in Israel, the company Cloudflare detected various denial-of-service (DDoS) attacks[1] against Israeli websites providing critical information about dangers and their early warning systems. These malicious actions against the “Red Alert” system were repeated consistently in the following hours (Yoachimik and Pacheco 2023), resulting in the dissemination of false or misleading information regarding threats to the Israeli population.

The cyberattacks were claimed by the hacktivist[2] pro-Palestinian group AnanGhost, adding to more than 40 collectives that claim to have launched actions against Israel (Roussi and Miller 2023). While this is a significant number of incidents, they did not substantially affect the use of cyberspace by the Israeli population and its armed forces. It cannot be definitively stated that these attacks were coordinated or directly executed by Hamas.

On the other hand, some Palestinian websites related to banking and the internet industry were also affected after the conflict erupted, either by pro-Israeli groups or by the cyber defense units of this country, although it is unclear whether there was a clear intention to deny them the use of cyberspace to limit any malicious actions they might undertake within this domain.

It is a fact that Israel has also been supported by hacktivists such as the group “Indian Cyber Force,” which has claimed to have executed actions in favor of the Israeli cause, provoking the ire of pro-Palestinian groups that announced measures against India itself (Sharma 2023). In this context, the involvement of groups external to the belligerent parties has generated a phenomenon worthy of analysis, which is the potential for cyberwarfare between third countries or non-state actors not directly involved in the conflict.

Two weeks after the attack on Israel, a message was published on a new channel of the Telegram platform, reporting the breach of the Nevatim airbase (Vicens 2023) and the acquisition of information about the facilities, pilots, and their families, along with photos taken from security cameras with the message “they will not be safe.” This maneuver was allegedly carried out by a pro-Palestinian group and not by Hamas, supporting the thesis that actions in cyberspace have primarily been conducted by third parties and not directly between the opposing parties. Another objective sought by the hacktivists has been to influence public opinion to attempt to justify the actions of the side they support.

Another attack was executed by a pro-Iranian group that managed to obtain information on thousands of military personnel, security, and intelligence staff from the United States, which was being sold for $2,000 in bitcoins on the dark web[3], all supposedly in response to U.S. support for Israel in its fight against Hamas (Vicens 2023).

It is highly likely that the actions mentioned are not the only ones that have occurred in this conflict; however, an analysis of the effects and scope of the attacks and Israel’s reaction allows us to conclude that it is probable that actions in cyberspace will continue, although they are unlikely to escalate in severity, at least in terms of public knowledge. It will take considerable time to access this information reliably.

Given the above, it is still hard to believe that a country as advanced in cybersecurity as Israel could have been affected by a group that, at least, would lack the sufficient connectivity to carry out significant actions in cyberspace. The truth is that Hamas is indeed employing this domain as another battlefield to support its actions, whether to attack or to attempt to dominate the information landscape.

However, with the information available so far, it cannot be definitively determined that the executed actions have significantly reduced the capabilities of the opposing forces. This is mainly because most of the known attacks have had limited reach, and the affected services have been able to recover quickly. Additionally, it is estimated that Israel is making greater use of cyberspace for intelligence operations (Lee 2023) and limiting access to services in Palestine, such as banking and the internet itself.

The Role of Cyberspace and Information Warfare

The use of cyberspace to obtain information and propagate disinformation is not new in warfare. However, in this conflict, this activity has reached a different dimension.

As terrorism operates in the symbolic realm, Hamas sought to maximize the impact of its attack by recording and disseminating the brutal actions it carried out against the civilian population, primarily using social media. Moreover, this was executed to coincide with the 50th anniversary of the Yom Kippur War, when Israel was taken by surprise by neighboring Arab states.

This group and pro-Palestinian associations around the world have also employed cyberspace to position a message favorable to them in the eyes of the international community, attempting to blame Israel for actions that in some cases were committed by militias such as Islamic Jihad, as in the case of the bombing of a hospital in Gaza.

Another element used to influence feelings and public opinion relates to the use by Hamas militants of cell phones belonging to Israeli victims, which were obtained after their incursions. Sources cited by the press have indicated that Hamas is calling from the obtained phones to relatives and friends to threaten and scare them, as well as to increase their suffering by broadcasting their executions live (Brewster 2023).

The most recent case of an information operation by Hamas was the release of two hostages, who later recounted that they had been treated well and even received medical support (Teibel 2023). This action has had a significant media impact, both on the population and the Israeli government. It is estimated that the signal intended to be conveyed is that the hostages can still be recovered and, therefore, Israel “should” limit its actions.

Final Considerations

Regardless of the particularities this conflict may have regarding the use of cyber operations, there are lessons and elements that must be taken into account to improve one’s own cyber defense capabilities.

1. While it is crucial to protect critical infrastructure from physical attacks, measures may be insufficient if they do not safeguard against attacks through cyberspace. Currently, cyber operations can be conducted by any group from anywhere in the world in support of a specific cause. Assuming that one is immune to an attack on critical digital infrastructure due to physical distance can be a difficult mistake to correct.
2. It is essential to continuously monitor and evaluate how actions in cyberspace evolve among countries and groups that are not directly related to a conflict. Escalation incurs minimal costs and is just around the corner.
3. The use of cyberspace serves many objectives: intelligence, information operations, deception, degradation of weapon systems, etc. This has been evidenced in both this conflict and that of Russia and Ukraine. Having units prepared to confront these actions is key to success; one cannot expect to develop such strategic capabilities when events occur, as the consequences at that moment can be severe.
4. Once the conflict concludes, a deeper analysis of the actions Israel took to protect cyberspace should be conducted, although some services that may have been attacked with minimal consequences and the population of the country has not seen its internet usage affected.
5. Defense against cyber operations is difficult to achieve and must be prepared in advance. Israel is a global power in cyber defense and has spent many years developing capabilities, which has allowed it to achieve a significant degree of resilience during the conflict.

---

[1] Distributed Denial of Service or Denial of Service attacks, which refer to attacks that deny access to computational services.

[2] Groups that use digital tools to attack in cyberspace and achieve political objectives

[3] The dark web is a part of the Internet that is hidden from search engines and conventional methods of accessing the web, requiring specialized methods and software.

By Javier Macías Araya, Master in Cybersecurity (c) from the University of Houston; Master’s in Military History and Strategic Thought from the War Academy; Major (ret.) and Staff Officer

October 31, 2023

The opinions expressed in this article are those of the author and do not necessarily reflect the views of AthenaLab.

References

Lee, Rob T (10/13/2023). How Cyberattacks Could Affect the Israel-Hamas War. At: https://www.bankinfosecurity.com/robert-t-lee-video-interview-a-23310

Yoachimik, Omar, and Jorge Pacheco (10/10/2023). Cyber attacks in the Israel-Hamas war. At: https://blog.cloudflare.com/cyber-attacks-in-the-israel-hamas-war/.

Roussi, Antoaneta, and Maggie Miller. (10/15/2023). How hackers piled onto the Israeli-Hamas conflict. Last accessed October 25: https://www.politico.com/news/2023/10/15/hackers-israel-hamas-war-00121593.

Sharma, Shweta (10/11/2023). Israel-Hamas conflict extends to cyberspace. Last accessed October 25: https://www.csoonline.com/article/655223/israel-palestine-conflict-extends-to-cyberspace.html.

Vicens, Aj. (10/24/2023). Cyber operations linked to Israel-Hamas fighting gain momentum. Last accessed October 25: https://cyberscoop.com/cyber-israel-hamas-gaza/.

Brewster, Thomas. (10/25/2023). Israeli War Evacuees Fear Hamas Stole Their Phones. Cyber Volunteers Are Helping Protect Them. Last accessed October 25, 2023: https://www.forbes.com/sites/thomasbrewster/2023/10/23/hamas-stole-israeli-phones-cyber-volunteers-help-secure-them/?sh=e449ecc4ae0f.

Teibel, Amy. (10/24/2023). Now freed, an Israeli hostage describes the ‘hell’ of harrowing Hamas attack and terrifying capture. Last accessed October 25: https://apnews.com/article/israel-hostage-hamas-militants-10b5491c6f63b4bf697c95f3ca052d61.

---

[1] Distributed Denial of Service or Denial of Service attacks, which refer to attacks that deny access to computational services.

[2] The dark web is a part of the Internet that is hidden from search engines and conventional methods of accessing the web, requiring specialized methods and software.

[3] Groups that use digital tools to attack in cyberspace and achieve political objectives.