Iran’s Cyberattacks on Israel Tripled During Recent Regional Conflict, Report Says

According to The National Interest, the United States and Israel have repeatedly struck Iran since the start of Operation Epic Fury at the end of February. The article says Iran has the military capability to target Israel with large stockpiles of ballistic missiles, cruise missiles and drones, but that its ability to carry out a successful large-scale strike has been heavily constrained by Israel’s advanced air defenses and the presence of US military assets in the region.

The article reports that Iran has turned much of its response online. Citing the report, it says cyberattacks against Israel tripled during the recent regional conflict, surging to more than 4,800 hostile incidents at the peak of the conflict. The article states that both the traditional Iranian military and the Islamic Revolutionary Guard Corps now operate cyberwarfare divisions that lead efforts against Israel. According to the article, these units are supported by civilians and activists working at the behest of Tehran, some of whom are paid while others act out of Iranian patriotism or anger toward Jerusalem.

Yossi Karadi, director general of the Israeli National Cyber Directorate, told the German newspaper Die Welt on Monday that “some groups are very skilled” and that “we can handle them, but we have to take them seriously.” He added, “Unlike in the kinetic realm, there’s no ceasefire in cyberspace.” Karadi described the threat as layered. At the core, he said, are cyberattack groups within Iran’s security apparatus and the Revolutionary Guards. Next are civilians who hack out of conviction or for pay, and then activists who want to harm Israel.

The article says the threat takes several forms. In some cases it involves direct attacks on infrastructure, while in others it involves online propaganda, including anti-Western videos that have gone viral on social media. It notes that because Iran has long used cyber as a force multiplier and a form of asymmetric warfare, such attacks were almost expected, and that Israel was prepared, at least for these types of attacks.

Ensar Seker, CISO of the cybersecurity provider SOCRadar, told The National Interest that the shift in targeting and intent matters as much as the number of incidents. He said nation-state campaigns rarely remain confined to government targets, and that critical infrastructure, defense contractors, telecommunications providers, logistics companies, healthcare organizations and multinational enterprises often become indirect targets or collateral victims. The article adds that organizations with no direct involvement in the conflict may still see more phishing, credential theft attempts, DDoS attacks or supply chain attacks.

The article reports that it is hard to know who is responsible for the different types of attacks being conducted, which makes the response harder. Brian Higgins, security specialist at the cybersecurity research firm Comparitech, told The National Interest that “attribution is incredibly challenging where cyberattacks are concerned” and that proving who is doing what in cyberspace “is not a definite science.” Higgins also said international humanitarian law prohibits targeting civilian infrastructure and indiscriminate digital warfare, but that international law offers little help when intelligence, not evidence, is the main defense against adversarial obfuscation. Careful attribution matters when facts are difficult to establish (Proverbs 18:17).

The article notes that Iran has so far been careful not to escalate the conflict through its online attacks, but that a quasi-independent group aligned with Tehran could carry out a far more destructive attack against Israel’s or the United States’ critical infrastructure. It also reports an increase in coordinated attacks involving cyber units, including the growing integration of cyber operations with kinetic military activity. Seker told the magazine that cyberattacks increasingly disrupt communications, spread disinformation, collect intelligence and distract security teams before or during physical operations, and that rapid detection, threat intelligence and cross-sector information sharing are more important than ever.

Source: Read the original report