Incident Analysis - Cyberwar: Israel – Iran

🔎INCIDENT ANALYSIS - Cyber war: Israel – Iran (April 2024)

S2W is releasing threat analysis reports for regions seeking information on dark web threats. Following our examination of the MENA region in the previous report, our April issue focuses on analyzing 해시태그cyber war incidents between 해시태그Israel and 해시태그Iran.

✅ Executive Summary:

- Following the Israel-Iran outbreak in April 2024, the volume of messages referencing both countries surged significantly among threat actors on Telegram.

- The '해시태그Ghost of Palestine' emerged as the most active threat actor group mentioning both 'Israel' and 'Iran' through their 해시태그Telegram channel. While they cited 'Iran' in support of the country, they also referenced 'Israel' to encourage other threat actors to target its infrastructure, attributing malicious actions against Iran.

- Other threat actors on Telegram channels exhibit similar behavior to the 'Ghost of Palestine,' prominently targeting Israel while disseminating messages in support of Iran.

- Despite the Israel-Iran outbreak, the number of postings on Darkweb hacking forums did not significantly increase. However, the 'Government' sector was the most affected industry for both countries.

- In case of Israel, threat actors were observed attempting to sell access to government servers and documents extracted from the 'Ministry of Defense.'

- The Iranian governmental agency '해시태그Behdasht' was targeted by a threat actor who joined a Darkweb hacking forum in April 2024. Apart from this incident, the threat actor did not make any other postings.

🧑‍💻 Report authors: Analysts Sunhyung Shim and Jay Oh

👉 For any inquiries, please contact us: https://s2w.inc/en/contact

*The full report is available upon request.