Israel

This page covers cyber threats to Israel. It brings together Israeli government documents, joint advisories from the United States, the United Kingdom, Canada and Israel, MITRE ATT&CK, news reports on named incidents, and Brandefense research.

Threat groups that official sources link to Israel

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT34 (OilRig): MITRE ATT&CK says that during a campaign it calls Juicy Mix, OilRig compromised an Israeli job portal and used it as a command server, and that during a campaign it calls Outer Space it did the same with an Israeli human resources site. MITRE describes OilRig as a suspected Iranian threat group.

APT35 (Charming Kitten): MITRE ATT&CK, under the name Magic Hound, says the group collected credentials from over 900 Fortinet VPN servers in the US, Europe and Israel. MITRE describes it as an Iranian-sponsored group that likely works on behalf of the Islamic Revolutionary Guard Corps.

Some actors named by official sources do not yet have a profile here. A joint advisory by CISA, the FBI, the NSA, the EPA, the Israel National Cyber Directorate, the Canadian Centre for Cyber Security and the UK NCSC (AA23-335A) says IRGC-affiliated actors using the persona CyberAv3ngers targeted Israeli-made Unitronics PLCs from November 2023. It adds that CyberAv3ngers has claimed attacks in Israel since 2020, and that several of those claims are false. An FBI notice of 2022 and an FBI, Treasury and Israel National Cyber Directorate advisory of 30 October 2024 say the Iranian group Emennet Pasargad has run hack-and-leak operations against organizations primarily in Israel. On 18 December 2023 the Israel National Cyber Directorate said the group Agrius, linked to the Iranian Ministry of Intelligence, and Hezbollah’s Lebanese Cedar unit were behind an attack on Ziv Medical Center.

Incidents on record

The incidents listed below are major ones that official bodies or national media documented. Where sources differ, the incident page says so. Small incidents are not listed.

How attackers target Israel: Brandefense research

Our own research has covered Israel many times. In summary, as our posts report:

Iran-linked espionage and disruption: our MuddyWater post says a campaign targeted SysAid servers in Israeli organizations through Log4j 2. The MENA review describes a 2024 MuddyWater campaign against Israeli organizations that used the BugSleep backdoor, and the BugSleep analysis says investigations suggest MuddyWater may be targeting countries such as Israel. The MuddyWater profile says its focus grew toward the defense and energy sectors of Israel and Saudi Arabia in 2022. The OilRig profile says 2024 attacks mostly targeted Israeli and Emirati defense companies.

The APT35 profile lists Israel among its countries of focus and a 2021 campaign against Israeli defense and technology companies. The APT42 profile mentions a 2024 joint effort using remote management software against Israeli and Central Asian targets. The Void Manticore profile says the group focuses on Israel and, in 2023, ran wiper attacks on critical infrastructure there. The UNC1549 analysis says the group targets aerospace and defense organizations in the Middle East, including Israel, citing CERT-EU. The BellaCiao analysis notes that its attackers sort victims by country code, including IL.

Hacktivism and leak operations: the Handala profile describes a group that defaces sites, runs DDoS attacks and leaks data to retaliate against Israel and Western supporters. The MENA review says Moses Staff encrypted systems of Israeli companies, stole data and leaked it without asking for payment. Our dark web spotlight reports mention a pro-Palestinian group, AnonGhost, claiming to have targeted the Israeli Defense Forces. The Anonymous Sudan review lists Israel among countries reached by its DDoS attacks.

Other state and criminal activity: the Cicada report lists Israel among countries where the group targeted government agencies and non-governmental organizations. The El Machete profile says that by 2022 the group targeted government, energy and finance in Venezuela, Israel, Saudi Arabia and Pakistan. The AvosLocker summary lists Israel among its targeted countries.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Israel National Cyber Security Strategy in Brief was published in September 2017 by the Prime Minister’s Office, National Cyber Directorate. It says the National Cyber Bureau was set up in January 2012 and reports directly to the Prime Minister. On 15 February 2015 the government adopted two resolutions, which included setting up the National Cyber Security Authority. Together the Bureau and the Authority make up the Israel National Cyber Directorate (INCD).

The strategy rests on three layers: aggregate cyber robustness, systemic cyber resilience and national cyber defense. Government Resolution 2443 of 15 February 2015 started nation-wide efforts to raise robustness through guidance, regulation and incentives.

How incident response is organized

The strategy says the National Cyber Security Authority is a hub of national knowledge, a primary cyber regulator and an operational center for managing cyber incidents. It adds that the national CERT works with the private sector directly and through sector-based cyber centers inside the CERT. In practice, the INCD announced in December 2023 that a joint investigation by the INCD, the IDF and the Shin Bet identified the attackers of Ziv Medical Center.

The official Israeli pages we could open give no attack counts, and we could not open the Privacy Protection Authority or Ministry of Health websites, so this page does not describe Israeli privacy or health-sector rules. Figures for Israel will come from Brandefense Atlas.