Cyber Threat Actor: Mossad

Mossad, also known as HaMossad leModiʿin uleTafkidim Meyuchadim, is the national intelligence agency of the State of Israel. It operates under the direct authority of the Israeli government and is tasked with foreign intelligence collection, covert operations, and counterterrorism. The agency's headquarters are situated in Israel, and it is publicly recognized as a core component of the country's national security apparatus. As a state‑run organization, Mossad's activities are aligned with the strategic interests of Israel, although specific operational details are often classified. Open‑source reporting has referenced the agency in connection with a variety of actions that include intelligence gathering, cyber operations, and influence campaigns. Its public aliases appear interchangeably in media coverage and official statements. The clear state nexus established by its governmental affiliation allows any openly attributed cyber activity to be linked to Israel's national security framework.

In June 2022, Iranian officials publicly attributed a cyberattack on Tehran's municipality to Mossad. The attackers compromised the city's security camera network, gaining control of video feeds. They also defaced the municipal website with images that denounced Iranian leadership. Beyond defacement, the intrusion disrupted internal systems, communication networks, and broader service infrastructure, leading to temporary interruptions in municipal operations. Tehran authorities reported that services were restored promptly after the incident and acknowledged existing cybersecurity shortcomings that had been exploited. The timing of the attack coincided with the anniversary of a significant national event in Iran, which officials noted amplified the symbolic impact of the operation. Public reports did not specify any particular malware families or exploit tools used, but the described actions indicate a focus on infrastructure disruption and information warfare. Attribution to Mossad was based on statements from Iranian officials and was supported by open‑source references that linked the incident to the agency. This case demonstrates how the agency's cyber activities can combine technical intrusion with propaganda elements to achieve strategic objectives. It remains one of the few publicly documented examples of Mossad's involvement in a disruptive cyber campaign against a foreign municipal target.