Cyber Conflict in the Middle East: Trends, Groups, and Impacts

A wave of digital conflict has unfolded alongside the real world danger in the Middle East. Days after air strikes began, a popular emergency alert app used by Israelis to receive bombardment warnings momentarily showed a near–nuclear attack alert. It wasn’t true, but it felt credible. The app is official in its use, and the international community is watching a period of heightened tension where nations hold atomic capabilities or seek them.

That terrifying mobile alert became one of the clearest signals of a cyber war playing out in the eastern Mediterranean. The contenders include Israel, Hamas and allied groups, Iran via nearby networks, and a broad pool of hackers who operate with varying degrees of independence. The battlefield is the cyber space, and the weapon most common is a distributed denial of service attack that overwhelms targets. The victims are the least protected infrastructure and the reputations of the involved sides.

Hacker factions

On October 8, one day after a large terrorist attack by Hamas against Israel, authorities attributed a cyber strike against the Dorad power plant in Ashkelon to a hacker group linked to Iran called Cyber Avengers. The full extent of the damage remains undisclosed.

On October 27, Israel throttled data flows to Gaza and attacked a large number of servers, triggering one of the most significant information outages in history. For 34 hours, the Gaza Strip had zero coverage, and recovery remains partial. The Palestinian telecom Jawwal was knocked out.

Between these incidents, observers noted a spike in activity. International researchers estimated around 70 pro–Palestinian hacker groups and about 15 aligned with Israel. In Spain, cybersecurity researchers counted 113 pro–Palestinian groups, 17 pro–Israel groups, and three independent outfits also targeting the conflict.

Among those groups are Silent One, Red Evils, and Israel Cyber Defence. Spanish military sources also point to non-Israeli support for the Indian Cyber Sanatani group.

The Israeli state, home to some of the world’s most powerful tech companies, does not rely on additional hacker help as much as Hamas does. Mirroring Ukraine’s experience after the Russian invasion, hacktivist collectives such as Ghosts of Gaza and Ghost of Palestine—supported by Iran—called on hackers worldwide to strike Israeli interests last October.

In Hamas’s camp are three Iranian groups Cyber Avengers, Agonizing Serpents, and Haghjhoyan; two Russian-inspired outfits Killnet and Anonymous Sudan; and two named groups that might draw scrutiny from authorities: Moroccan Ghosts and the Moroccan Black Cyber Army.

Bus pass no longer in use

That Moroccan group—perhaps Moroccan and Russian at once—has been linked to cyberattacks on mobility networks. Their latest operation occurred on February 15, coordinated with Killnet and Anonymous Sudan and with Team 1956, which forced Egged, Israel’s public transport operator, to suspend ticketing for a second time in the conflict.

Israelis have also struck in cyberspace, but against Iran rather than Gazan targets. In December, Red Evils breached and disrupted Iran’s judicial network and published court records to expose corruption in the country.

That same month, Iran’s Cyber Avengers successfully attacked the water authority in Aliquippa, Pennsylvania, drawing broad attention.

Hiding in plain sight

There are many names, but not always many people. Hacktivists move between groups, joining several at once. Their polyphony gives the impression of many actors, a warning echoed by the Spanish military source.

Some disagree with the term cyberwar. Josep Albors, head of research and awareness at a leading European cybersecurity firm, avoids labeling it a cyberwar because it has not been formally declared and its arena is not exclusively cyberspace. He describes the activity as a set of hybrid operations that complement kinetic warfare or illicit actions taken as part of a cyber battlefield preparation.

Private security observers, including ESET, function as informal monitors in the cyber war, spotting activity spikes. Albors notes that many campaigns could be counterfeit or false-flag operations designed to mislead.

More Spanish private security work reveals that the X63 unit, part of Cipher under Prosegur, has tracked the use of the Stone malware, reportedly used by Gazan actors, with confirmation from security experts.

Who has the upper hand

The risk of strikes against critical infrastructure and businesses has intensified to the point that Israel’s National Cyber Directorate issued a citizen alert on January 7. The briefing described rising cyber attack intensity on Israel, including simple DDoS on websites, supply chain disruptions, and networked cameras used for intelligence gathering.

The report warned of phishing campaigns and targeting of mobile apps, as well as Internet-facing equipment from Cisco or Juniper, VPNs from Fortinet and Citrix, and CMS and WordPress platforms. Among the sectors most targeted by pro–Hamas hackers were the airlines.

As Israel issued this warning, a curious tactic emerged from the cyber front: social media messages intended to coax soldiers into revealing their location by engaging with provocative prompts from attractive accounts and similar schemes.

By day 154 of the conflict, no expert would claim a clear winner in the cyber space. An Israeli military official noted that the cyber dimension will likely persist beyond any physical ceasefire. Albors reframed the question simply: who is winning in this space is a matter of definition.

Citations

Attribution: various security researchers and official briefings provide ongoing observations about the breadth of groups, campaigns, and tactics in this multi-front cyber conflict. These insights help explain how cyber operations align with traditional conflict dynamics and how defenders and researchers track shifting threat activity in real time.