The #OpIsrael campaign has been repeated every year since 2013. Last year, the campaign failed to achieve his main goals, as the participants did not succeed in carrying out any significant cyber attacks against high-profile targets, such as government or financial websites. They only managed to deface private Israeli websites and leak databases (most of which were recycled from previous campaigns).
This year, we noticed that the number of the expected participants is relatively low – approximately 2,100 Facebook users have expressed a desire to participate in the campaign via dedicated #OpIsrael anti-Israel Facebook event pages. This constitutes half the number of participants that we detected in 2015 (approximately 5,200 Facebook users). There may be several reasons for this low number, one being disappointment from last year’s lack of significant achievements. Another reason could be attention devoted to other factors, such as the cyber campaign against the Islamic State (IS) following the recent terrorist attacks in Brussels.
This year we detected 13 different #OpIsrael event pages – the same number of event pages detected in 2015. The most popular page is one created by two Tunisian hacker groups dubbed Fallaga and Tunisian Cyber Resistance.
Of note, many participants will join several event pages concurrently. Therefore, the actual number of Facebook users that wish to participate in this year’s campaign is actually less than 2,000. According to our analysis, most of the discussions about the campaign on social media networks are taking place in North Africa (Tunisia in particular) and Southeast Asia (notably in Indonesia).
We have identified additional platforms where anti-Israel hacktivists are preparing for the #OpIsrael campaign: closed and secret Facebook groups, Telegram and IRC channels and closed forums. The AnonGhost team has opened two Telegram channels for the purposes of updating and sharing information. In addition, the group has opened a dedicated website for the campaign, but it is offline at present.
We also witnessed an interesting chat on an IRC channel dedicated to #OpIsrael, where one of the conversation participants said that hacktivists affiliated with Anonymous do not have time to participate in the #OpIsrael campaign because they are preoccupied with their cyber war against targets identified with the Islamic State.
With regard to the attack vectors, we assume the attackers will attempt to carry out DDoS attacks or leak the databases of small Israeli websites (based on past experience, most of the data leakage will be recycled from previous campaigns). We also believe they will use familiar or self-developed DDoS tools, as well as malware based on njRAT, which is very popular among Arabic-speaking hacktivists.
It is also possible that there will be attempts to infect Israeli end-points with Ransomware via emails with malicious files during this campaign. In most cases, these malicious emails pose as invoices, fax notifications or fake purchase orders to deceive unsuspecting users. Moreover, attackers sometimes spoof an internal email address to alleviate the concerns of potential victims.