Cyber Threat Actor: Hamas

Hamas,also known as Harakat al-Muqawama al-Islamiyya and the Islamic Resistance Movement, is a Palestinian militant group based in Palestine. Open‑source reporting indicates that the group’s cyber operations are directed chiefly at targets within Israel, focusing on Israeli military personnel, civilian populations, and media organizations. The stated purposes of these activities include espionage, disruption of services, and psychological intimidation. Hamas has sought to collect intelligence on Israeli soldiers by compromising their smartphones, has interfered with live digital broadcasts to disseminate threatening imagery, and has distributed mass text messages designed to provoke fear of rocket attacks and kidnappings. These actions are described in publicly available sources as part of the group’s effort to exert pressure on Israeli society and obtain actionable intelligence.

The group’s observed tactics involve social engineering through fabricated online personas on platforms such as Facebook, WhatsApp, Telegram, and Instagram, where attackers pose as attractive individuals to lure targets into downloading malicious applications. These applications, masquerading as chat apps like GrixyApp, ZatuApp, and Catch&See, actually contain a mobile remote access trojan (MRAT) that communicates with command‑and‑control servers via the MQTT protocol. The MRAT can harvest phone numbers, GPS data, storage contents, SMS messages, contact lists, and pictures, and it can be instructed to take photographs, download and execute additional files, or expand its capabilities through remote commands. Attribution to Hamas is explicit in multiple sources: the APT‑C‑23 cluster linked to the MRAT campaign is identified as associated with Hamas, and incidents such as the 2018 fake dating‑app espionage plot, the 2019 Eurovision webcast disruption, and the 2014 mass SMS intimidation campaign are all publicly credited to Hamas militants. No public reporting cites a direct state sponsor or criminal consortium for these activities.