Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Yet Another Diminishing Spark: Low-level Cyberattacks in the Israel-Gaza Conflict

Anh V. Vu, Alice Hutchings, Ross Anderson

TL;DR

The study investigates the role of low-level cybercrime actors in the Israel-Gaza conflict, focusing on web defacement and UDP amplification DDoS to quantify attacker activity and community reactions. It combines datasets from defacement archives, a UDP-specific honeypot, hacking forums, and Telegram channels, spanning 1 Aug 2023 to 31 Jan 2024, and applies Kruskal-Wallis tests with Dunn’s post-hoc analyses across three eras around the Hamas attack. Findings show sharp but short-lived surges in defacement and DDoS activity, with attacks heavily skewed toward Israeli targets and far less against Palestine or other countries, compared to patterns observed in the Russia-Ukraine war. The results highlight rapid mobilization followed by rapid attrition, influenced by differences in infrastructure and cybercrime ecosystems, and offer a data-driven, ethics-conscious framework for studying non-state cyber operations in contemporary conflicts.

Abstract

We report empirical evidence of web defacement and DDoS attacks carried out by low-level cybercrime actors in the Israel-Gaza conflict. Our quantitative measurements indicate an immediate increase in such cyberattacks following the Hamas-led assault and the subsequent declaration of war. However, the surges waned quickly after a few weeks, with patterns resembling those observed in the aftermath of the Russian invasion of Ukraine. The scale of attacks and discussions within the hacking community this time was both significantly lower than those during the early days of the Russia-Ukraine war, and attacks have been prominently one-sided: many pro-Palestinian supporters have targeted Israel, while attacks on Palestine have been much less significant. Beyond targeting these two, attackers also defaced sites of other countries to express their war support. Their broader opinions are also largely disparate, with far more support for Palestine and many objections expressed toward Israel.

Yet Another Diminishing Spark: Low-level Cyberattacks in the Israel-Gaza Conflict

TL;DR

The study investigates the role of low-level cybercrime actors in the Israel-Gaza conflict, focusing on web defacement and UDP amplification DDoS to quantify attacker activity and community reactions. It combines datasets from defacement archives, a UDP-specific honeypot, hacking forums, and Telegram channels, spanning 1 Aug 2023 to 31 Jan 2024, and applies Kruskal-Wallis tests with Dunn’s post-hoc analyses across three eras around the Hamas attack. Findings show sharp but short-lived surges in defacement and DDoS activity, with attacks heavily skewed toward Israeli targets and far less against Palestine or other countries, compared to patterns observed in the Russia-Ukraine war. The results highlight rapid mobilization followed by rapid attrition, influenced by differences in infrastructure and cybercrime ecosystems, and offer a data-driven, ethics-conscious framework for studying non-state cyber operations in contemporary conflicts.

Abstract

We report empirical evidence of web defacement and DDoS attacks carried out by low-level cybercrime actors in the Israel-Gaza conflict. Our quantitative measurements indicate an immediate increase in such cyberattacks following the Hamas-led assault and the subsequent declaration of war. However, the surges waned quickly after a few weeks, with patterns resembling those observed in the aftermath of the Russian invasion of Ukraine. The scale of attacks and discussions within the hacking community this time was both significantly lower than those during the early days of the Russia-Ukraine war, and attacks have been prominently one-sided: many pro-Palestinian supporters have targeted Israel, while attacks on Palestine have been much less significant. Beyond targeting these two, attackers also defaced sites of other countries to express their war support. Their broader opinions are also largely disparate, with far more support for Palestine and many objections expressed toward Israel.

Paper Structure

This paper contains 10 sections, 6 figures, 1 table.

Table of Contents

  1. Introduction
  2. Cyber Operations in Armed Conflicts
  3. Methods and Datasets
  4. Datasets
  5. Statistical Tests
  6. The Evidence of Cyberattacks
  7. Website Defacement Attacks
  8. UDP Amplification DDoS Attacks
  9. The Hacking Community Reactions
  10. Concluding Remarks

Figures (6)

  • Figure 1: Number of self-reported defacements (top) and DDoS attacks (bottom) on Israel and Palestine over the period. Some attack levels escalated shortly after the war began but then rapidly dropped. The red star marks the Hamas strike.
  • Figure 2: The number of website defacement attacks targeting Israel and Palestine, broken down hour by hour. The red star marks the Hamas attack on 7 October 2023.
  • Figure 3: Defacements (top) and defacers (bottom) targeting Israel around 7 October 2023, in comparison with those seen with Russia and Ukraine in February 2022 vu2024getting.
  • Figure 4: Daily posts and posting users on Hack Forums mentioning Israel and/or Palestine (top five subforums).
  • Figure 5: Number of daily announcements and domain names targeted by the Cyber Army of Palestine group.
  • ...and 1 more figures