Israel Security Agency

Summary

Hackers affiliated with Anonymous disrupted access to key Israeli government websites, including those of the Israel Defense Forces, the Bank of Israel, and the Prime Minister's office, in retaliation for the alleged shutdown of the group's social media accounts. The attackers, operating under the AntiSec alias, publicly listed the targeted sites on Pastebin and cited solidarity with Gaza as motivation, aiming to halt military actions against the region. Several services remained offline following the breach, compounding prior disruptions to the IDF's digital presence, which included a previous Twitter account hijack by another threat actor promoting false warnings.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 25, 2014, hackers identifying with the Anonymous collective disrupted access to multiple high-profile Israeli government websites, including those of the Israel Defense Forces (idf.gov.il), the Bank of Israel, and the Israeli Prime Minister. The attackers publicly claimed responsibility through a Pastebin post published on August 24 under the alias AntiSec, listing the targeted websites and framing the operation as retaliation for the alleged shutdown of Anonymous-affiliated social media accounts. The hackers explicitly stated their actions were intended to demonstrate solidarity with Gaza and to pressure Israel to halt military operations in the region. The IDF website remained inaccessible at the time of reporting, with some services still offline. The attackers reinforced their persistence in the Pastebin message, declaring that even if individual participants were apprehended, others would continue their campaigns. They included a quote emphasizing the necessity of action to achieve results.

This incident followed a pattern of previous cyber disruptions targeting Israeli government digital assets. Notably, the IDF’s online infrastructure had experienced prior compromises, including a July 2014 incident where the Syrian Electronic Army hijacked its official Twitter account to disseminate false warnings about a nuclear leak after rocket strikes near the Dimona facility. The August 2014 website takedowns represented an escalation in tactics, directly impairing core government services rather than solely leveraging social media platforms. The attackers amplified their message through affiliated Twitter accounts, such as @AnonymousGlobo, which shared a "Tango Down" notification referencing the operation (#OpSaveGaza) and listing compromised domains. No specific remediation efforts or technical responses from the affected Israeli entities were detailed in the available reporting at the time of the incident’s disclosure.

Sources

Sources available to members: 1 source.