Who masterminded largest-ever cyberattack on Israel?

Israel’s Defence Ministry is scrambling to identify the perpetrator of a large-scale cyberattack that brought down a string of government websites.

Targets included the websites of the prime minister and the ministries of defence and the interior, in what was believed to be “the largest-ever cyberattack on the country”, Al Jazeera reported.

Israel’s National Cyber Directorate (NCD) said the assault was a “denial of service” attack – in which cybercriminals “overwhelm their victims’ servers with a flood of data requests to paralyse them”, the broadcaster explained.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

‘Dramatic increase’

The NCD “declared a state of emergency in order to study the extent of the damage caused by the ‘massive’ cyberattack” on Monday evening, when government websites were knocked offline for more than an hour, The Times of Israel reported.

In a statement during the outage, the Communications Ministry said: “Operations have been carried out by communications companies in order to return the service as soon as possible, and the service is gradually returning. The ministry will continue to monitor [the situation] until full restoration.”

The country’s “​​defence establishment” was also “checking strategic Israeli websites and government infrastructure, such as Israel's electric and water companies, to see whether they were also attacked”, Haaretz reported.

But the chief targets appeared to have been “websites using the .GOV.IL domain, which is used for all government websites save for defence-related ones”, the news site added.

The NCD last year warned of “a dramatic increase” in the “scale and quality of cyberattacks worldwide and in Israel”, Al Jazeera said.

Foreign enemy

A senior defence official told Haaretz that they believed “a state actor or large organisation” carried out the latest attack. But Israel has yet to name any suspects.

The attack followed allegations of a failed Mossad operation against Iran.

According to Iranian media, the Israeli intelligence service attempted to attack “the Islamic Republic of Iran’s key Fordow nuclear enrichment site”, said The Jerusalem Post. But “there was no way to independently confirm the report”.

Iran “frequently claims to have busted Mossad cells when actually it is merely arresting local opposition elements”, the paper continued. However, “some speculated” that the cyberattack “was part of Iranian retaliation for the alleged attempted sabotage of Fordow”.

Previous hacks on Israeli websites have also been “attributed to attackers linked to Iran”, said Al Jazeera. The two rival nations have long been “locked in a shadow war that includes cyberattacks as well as the targeting of physical sites”.

The New York Times reported last November that both countries had broadened their cyberwar “to attack civilian targets”, after a cyberattack on Iran’s nationwide fuel distribution system “paralysed” the country’s 4,300 gas stations.

The outage “was followed days later by cyberattacks in Israel against a major medical facility and a popular LGBTQ dating site”, the paper said – attacks that Israeli officials blamed on Tehran or Iranian-backed groups.

While Iran was still investigating the latest cyber assault, former senior Israeli cyber authority official Rafael Franko told The Jerusalem Post that a hacking group affiliated to Iran was “behind cyberattacks on the diamond exchange over the weekend”.

He warned that Israel should remain high alert “during this rocky period and leading into the Passover holiday, when Israeli adversaries often mount cyberattacks”.