How the Israel-Iran conflict is developing in cyberspace
As the conflict between Israel and Iran approaches the first-week mark, both countries are leaning into cyberspace to launch attacks.
A possible Israeli-linked hacking group has claimed responsibility for disrupting operations at an Iranian bank and flooding the crypto market with approximately $90 million (€77 million) in stolen funds.
Meanwhile, Israeli officials reported fake messages sent to the public alerting them of terrorist attacks against bomb shelters to sow panic.
Both countries are also known for having a long history of cyberattacks against each other, according to US-based cybersecurity firm Radware.
'In the days since the fighting began, government-backed hackers, patriotic hacktivists, online propagandists, and opportunistic cybercriminals have all been active,' the company said in its threat alert dated June 18.
The anti-Iranian hacking group with possible ties to Israel,Gonjeshke Darande, or 'Predatory Sparrow,' claimed an attack on one of Iran's most prominent banks, Bank Sepah, this week, according to a statement they published on X.
Iranian media reported at the time that people had difficulties accessing their accounts, withdrawing cash or using their bank cards.
The US Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned Bank Sepah in 2018 for supporting Iran's military.
The hacking group then went after Nobitex, one of Iran's main cryptocurrency exchanges. The group claimed they burned $90 million from accounts that belong to the Israeli regime and, by Thursday morning, had posted the source code for the platform.
In a statement on X posted on Wednesday, Nobitex claimed that the assets were transferred to a wallet 'composed of arbitrary characters,' an approach they say 'deviates significantly from conventional crypto exchange hacks'.
'It is clear the intention behind this attack was to harm the peace of mind and assets of our fellow citizens under false pretences,' Nobitex wrote.
Nobitex estimates the amount stolen is closer to $100 million (€87 million)
The Iranian government has asked people to delete the social messaging app WhatsApp and has begun internet blackouts that have taken the country offline for 'over 12 hours' due to 'Israel's alleged 'misuse' of the network for military purposes,' according to internet monitoring companies Netblocks and Censys.
Iran's Tasnim News Agency, a news service associated with the Iranian military, claimed the Internet blackouts are 'temporary' due to the 'special conditions of the country,' and that it will come back when the 'situation returns to normal'.
Gonjeshke Darande has been linked to other cyber attacks in Iran, like the 2010 Stuxnet attack.
Stuxnet was a computer virus that damaged or destroyed the centrifuges, a key component used to enrich uranium, at Iran's uranium enrichment facilities in Natanz, one of the facilities targeted in the recent missile fire from Israel.
US media reports believe Stuxnet was carried out by Israel with support from the United States, who built the program. It's also believed that Israel's Defence Forces Unit 8200 was involved in the attack, according to Reuters.
Gonjeshke Darande has also taken credit for other cyber attacks against Iran, such as the 2022 attack on Iran's steel plants and the 2023 attack on gas stations.
At the time of the steel plant cyber attacks, Gonjeshke Darande released on social media what they called 'top secret documents and tens of thousands of emails' from Iran's three leading companies to show how the firms were working with the Islamic Revolutionary Guard Corps, a primary branch of Iran's military.
Israeli media reported people receiving fraudulent text messages claiming to come from the Israeli Defence Forces (IDF) Home Front Command that warned of attacks onbomb shelters.
The messages from OREFAlert were identified as fake by the Israeli authorities, who claim pro-Iranian groups are behind it as a way to sow panic during the operation against the Iranian military, called Operation Rising Lion.
Another fake message circulated that said fuel supplies would be suspended for 24 hours, according to the Jerusalem Post.
Ron Meyran, the VP of Cyber Threat Intelligence at US-based cybersecurity firm Radware, told the newspaper that there was a 700 per cent increase in cyberattacks against Israel in the first two days of the conflict with Iran, which comes from cyber retaliation from Iranian state actors.
Those actions include infiltration attempts targeting critical infrastructure, data theft and malware distribution, Meyran added. Euronews Next reached out to Radware to independently confirm these numbers but did not hear back at the time of publication.
A report from Radware says it expects Iran to make use of 'its well-developed network of fake social media personas to shape perceptions of the conflict.'
'During this crisis, observers have seen pro-Iran bot accounts amplifying hashtags about alleged Israeli atrocities and portraying Iran's actions as defensive,' the report said.
The bots 'frequently pose as ordinary citizens to make the messaging more persuasive,' it added.
Radware also noted in its report that at least 60 of the 100 hacktivist groups that have sprung up since the start of the conflict last week are pro-Iran and are either from the Middle East or Asia.
These groups have launched 30 denial of service (DDos) attacks per day against Israel that disrupt normal traffic to a website, Radware found. Some of these groups have also threatened cyber attacks against the United Kingdom and the United States if leadership there decides to 'join the war against Iran'.
Iran has a 'considerable number' of state-sponsored threat groups that have targeted Israel in the past, like Muddy Water, APT35 (OilRig), APT35 (Charming Kitten) and APT39 (Remix Kitten), the Radware report continued.
These groups, with the help of Iran's Islamic Revolutionary Guard Corps, have targeted Israeli infrastructure, conducted malware campaigns and cyberespionage according to local media.
These cyber attacks increased following the start of the conflict between Israel and Hamas in Gaza in 2023, according to a 2024 report by Microsoft.
A SpaceX rocket being tested in Texas exploded Wednesday night, sending a dramatic fireball high into the sky.
The company said the Starship 'experienced a major anomaly' at about 11 pm local time while on the test stand preparing for the tenth flight test at Starbase, SpaceX's launch site at the southern tip of Texas.
'A safety clear area around the site was maintained throughout the operation and all personnel are safe and accounted for,' SpaceX said in a statement on the social platform X.
Elon Musk's company SpaceX said there were no hazards to nearby communities. It asked people not to try to approach the site.
The company said it is working with local officials to respond to the explosion.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
LeMonde
3 hours ago
- LeMonde
US judge orders release of pro-Palestinian Columbia student Mahmoud Khalil
A federal judge ordered the Trump administration on Friday, June 20, to release Mahmoud Khalil, a Columbia University student who became a leader of pro-Palestinian campus protests. Khalil, a legal permanent US resident who is married to a US citizen and has a US-born son, has been in custody since March facing potential deportation. District Judge Michael Farbiarz ordered Khalil's release on bail during a hearing on Friday, according to a court order seen by AFP. Since his March 8 arrest by Immigration and Customs Enforcement agents, Khalil has become a symbol of President Donald Trump's campaign to stifle pro-Palestinian student activism against the Gaza war, in the name of curbing anti-Semitism. At the time a graduate student at Columbia University in New York, Khalil was one of the most visible leaders of nationwide campus protests against Israel's war in Gaza. Following his arrest, US authorities transferred Khalil, who was born in Syria to Palestinian parents, nearly 2,000 kilometers (1,242 miles) from his home in New York to a detention center in Louisiana, pending deportation. His wife Noor Abdalla, a Michigan-born dentist, gave birth to their son while Khalil was in detention. Secretary of State Marco Rubio has invoked a law approved during the 1950s Red Scare that allows the United States to remove foreigners seen as adverse to US foreign policy. Rubio argues that US constitutional protections of free speech do not apply to foreigners and that he alone can make decisions without judicial review. Hundreds of students have seen their visas revoked, with some saying they were targeted for everything from writing opinion articles to minor arrest records. Farbiarz ruled last week that the government could not detain or deport Khalil based on Rubio's assertions that his presence on US soil poses a national security threat. The government has also alleged as grounds to detain and deport Khalil that there were inaccuracies in his application for permanent residency.
France 24
6 hours ago
- France 24
Supreme Court allows US victim suits against Palestinian authorities
The court issued a unanimous 9-0 decision in a long-running case involving the jurisdiction of US federal courts to hear lawsuits against the Palestinian Authority (PA) and Palestine Liberation Organization (PLO). Americans killed or injured in attacks in Israel or the West Bank or their relatives have filed a number of suits seeking damages. In one 2015 case, a jury awarded $655 million in damages and interest to US victims of attacks which took place in the early 2000s. Appeals courts had dismissed the suits on jurisdiction grounds. Congress passed a law in 2019 -- the Promoting Security and Justice for Victims of Terrorism Act (PSJVTA) -- that would make the PLO and PA subject to US jurisdiction if they were found to have made payments to the relatives of persons who killed or injured Americans. Two lower courts ruled that the 2019 law was a violation of the due process rights of the Palestinian authorities under the US Constitution but the Supreme Court ruled on Friday to uphold it. "The PSJVTA reasonably ties the assertion of federal jurisdiction over the PLO and PA to conduct that involves the United States and implicates sensitive foreign policy matters within the prerogative of the political branches," Chief Justice John Roberts wrote. The PA announced in February that it would end its system of payments to the families of those killed by Israel or held in Israeli prisons, responding to a long-standing request from Washington. In 2018, during his first term as US president, Donald Trump signed into law rules suspending financial assistance to the PA as long as it continued to pay benefits to Palestinians linked to "terrorist" entities, according to the criteria of the Israeli authorities.
France 24
6 hours ago
- France 24
Drone factories, camouflaged trucks: Iran releases images of Israel's covert operation
The Israeli drones successfully neutralised several of the Islamic Republic's anti-air defences deep inside its territory. What is particularly surprising is that some of these drones were manufactured in covert production facilities deep within Iran. Iranian state TV has broadcast images showing camouflaged lorries and vans that were used to transport the drones, as well as images of the makeshift FPV factories. The Israeli attack on Iran began on June 13. Its first targets were commanders of the Revolutionary Guard Corps, nuclear scientists, and military and nuclear facilities. According to Israeli information, 16 IRGC commanders and 14 nuclear scientists were eliminated by the Israeli army in the first round of attacks on Iran. Eyewitnesses report that from the very first moments, small drones and FPVs were seen or heard in the skies of several Iranian cities, particularly Tehran. Videos released by the Israeli Defense Forces (IDF) show these small drones attacking Iran's missile systems. Additional footage reveals the drones being launched from inside Iran, demonstrating their use against targets within the country. In response to the widespread use of this tactic by infiltrated Israeli agents on the ground in Iran, the Iranian regime's security forces on June 14 were compelled to publicly urge the people of Iran to stay vigilant and report any suspicious lorries, vans, or activities to the authorities. Images of these lorries and vans, converted to transport FPV drones and discovered by citizens or security forces, were widely shared on social media. State-run television and pro-regime outlets also aired videos showcasing hidden, makeshift drone production facilities discovered near Tehran and Isfahan. In one of the videos, the state TV presenter shows kits for small drones that are ready for production. According to the report, this makeshift facility was located covertly in a three-storey building near Tehran. But were Israeli agents able to establish drone-production sites right under the nose of Iran's intelligence services? 'Most of this system is designed for internal repression' Farzin Nadimi, a research fellow at the Washington Institute and an expert on Iranian weaponry, explains: We have known for many years about the deep infiltration of Israeli assets, almost at every level of the IRGC, the IRGC intelligence service, other intelligence services of Iran, the military and among politicians. In my opinion, the main cause could be corruption. But it's not only that. There is a lot at stake when working with Israel in Iran. With all the risks involved, money can't be the only motivation. When they see how corrupt the system is, they lose respect and loyalty for it, and the higher their rank, the better they understand how corrupt the whole system is. Multiple Iranian officials had issued warnings about the infiltration of Israeli agents within Iran, including at high-ranking levels of the IRGC and the broader power structure. In an unprecedented speech in 2021, Ali Younesi, former intelligence minister of Iran, stated: 'Over the past ten years, the Mossad [Israel's main intelligence agency] has infiltrated several of the regime's structures, to the point that every single Iranian official must now worry for their own life. Any attack is now possible.' On another occasion, Mahmoud Ahmadinejad, former president of Iran, claimed in a 2024 interview with CNN Türk: 'The head of Iran's counterintelligence, tasked with finding Mossad operatives, was himself an Israeli agent.' Nadimi continues: On the other hand the Iranian secret services have trained their apparatus for internal security risks. Most of this system is designed for internal repression and internal protests, and they have seen these protests as the more urgent threat than a foreign attack. Nadimi emphasises that he's not surprised that Iranian intelligence services are caught off guard by these drones: In fact, it is not so complicated to smuggle them into Iran. These drones consist of small parts that are easy to smuggle into Iran. Many parts are easy to manufacture in Iran, such as fibreglass parts. The controls and other electronic parts would be easy to smuggle into Iran via the Persian Gulf region, e.g., Dubai and other borders. For a complex mission like this, however, you can't rely entirely on locals and local assets, you need to have agents on the ground. They had planned this for a long time. They claim to have been working on this plan for many years. The Iranian authorities have cut the internet connection since June 18, and claim this has significantly curbed FPV and small drone attacks since then. Nadimi explains: Drone technology has made enormous progress in recent years, particularly in the Russia-Ukraine war. In this war, we have seen drones or FPVs use different types of technologies. We have seen that the Ukrainians use mobile phone networks to guide their drones deep into Russian territory. Thanks to the mobile network, they send information and users can also send them commands. This is quite useful and practical. So these drones could have relied on the 5G, mobile and LTE networks, so a disruption of the network at this level could theoretically have a partial impact on them. This is not the first time Israeli agents have infiltrated Iran in recent years. In July 2024, Israel successfully targeted and killed Ismail Haniyeh, the political leader of Hamas, during a visit to Tehran. He was killed by a precise strike on his room in a protected compound in northern Iran. On November 27, 2020, Israel also succeeded in eliminating Mohsen Fakhrizadeh, the scientist whom Western intelligence agencies and Israel believed to be the mastermind behind "Project Amad", Iran's covert effort to build a nuclear bomb in the early 2000s. He was killed on his way home when he came under fire from a machine gun mounted on a parked truck, which was remotely controlled via satellite.
