Israeli Public Broadcasting Corporation

Summary

A pro-Iranian cyber group from Iraq, al-Tahera, claimed responsibility for distributed denial-of-service (DDoS) attacks targeting multiple Israeli entities, including KAN news, a Russian-language television channel, and the national Airports Authority. The attacks temporarily disrupted website accessibility for the media outlets, though operational systems remained uncompromised according to official statements. The group coordinated its actions to coincide with symbolic timing linked to the assassination of an Iranian military commander and released propaganda imagery amid heightened regional tensions. Sabareen, a pro-Iranian Telegram channel, publicly issued threats prior to the attacks and subsequently claimed credit, framing the operations as part of broader geopolitical confrontations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 19-20, 2022, pro-Iranian cyber actors conducted distributed denial-of-service (DDoS) attacks against multiple Israeli entities, including KAN news. The Iraqi group al-Tahera, operating through the Telegram channel Sabareen, claimed responsibility for these operations. The initial attack occurred on Tuesday night (April 19), targeting KAN news and Israeli Russian-language Channel 9 websites, rendering both temporarily inaccessible. Sabareen announced the attacks in broken Hebrew on April 18, threatening "quality operations from Iraqi ground" to occur on Wednesday, April 20. The timing of the April 19 attack at 1:02 a.m. local time deliberately coincided with the exact hour of IRGC Quds Force commander Qassem Soleimani's assassination by US forces in Baghdad on January 3, 2020. Both media outlets restored service by Wednesday morning, with Channel 9 confirming they had experienced a DDoS attack overnight.

The campaign escalated on Wednesday evening (April 20) with al-Tahera claiming a DDoS attack against the Israel Airports Authority (IAA) website. The IAA acknowledged the attack but emphasized no operational systems were compromised and no damage occurred beyond temporary website disruption. Concurrently, Sabareen disseminated propaganda imagery featuring soldiers superimposed at Jerusalem's Dome of the Rock with the caption "Sabareen Special Forces defending Jerusalem," aligning the cyber operations with heightened regional tensions surrounding the Temple Mount. The group maintained consistent messaging across attacks, linking their cyber activities to geopolitical grievances and symbolic dates while avoiding physical infrastructure compromise. All targeted organizations publicly confirmed the attacks and restored services within hours, with no reports of data breaches or persistent network access by threat actors.

Sources

Sources available to members: 2 sources.