Loading story…
Hacktivist groups rapidly turned the Israel-Hamas war into a parallel cyber conflict, launching DDoS attacks, website defacements, data leak claims, and disruptive messaging operations against media outlets, government sites, private companies, and public-facing services. Reports said the Jerusalem Post suffered outages, the Israeli Red Alert missile warning app was targeted, and broader campaigns such as #OpIsrael and OpsRise mobilized pro-Palestinian, pro-Russian, and other aligned actors against Israeli targets. Researchers also noted retaliatory activity by pro-Israel groups against Palestinian entities, while spillover attacks hit organizations in countries seen as backing one side or the other.
The activity extended beyond websites into physical and operational systems. Attackers reportedly hijacked Israeli smart billboards to display pro-Hamas messages, while analysts warned that opportunistic actors were probing critical infrastructure and operational technology tied to power, water, fuel, and ISP networks. Cybersecurity firms and news outlets described the campaign as dominated by loosely coordinated hacktivist collectives, with pro-Palestinian groups outnumbering pro-Israel actors and some cybercriminals joining the fray. At the same time, the Israel-linked group Predatory Sparrow resurfaced amid the fighting, underscoring concerns that more capable state-aligned or advanced threat actors could deepen the conflict's cyber dimension.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
A CYFIRMA report described a sharp escalation in cyber activity tied to the war, including attacks on government entities, media, private organizations, and infrastructure-related targets such as power, water, fuel, and ISP systems. The report also assessed that pro-Palestinian hacktivist groups outnumbered pro-Israel groups and warned that APT involvement was likely though not yet confirmed.
Attackers infiltrated smart billboards in Israel and displayed pro-Hamas messages. The incident showed the conflict extending beyond websites into connected public-facing systems.
CyberScoop reported the reemergence of the Israel-linked hacking group Predatory Sparrow during the Gaza fighting. Its return raised attention to the possible involvement of more sophisticated actors beyond hacktivist groups.
After Indian Cyber Force's reported operations against Palestinian targets, Delhi government websites were subjected to retaliatory DDoS attacks. The incident illustrated how the cyber conflict spread to states perceived as backing one side.
The pro-India, pro-Israel group Indian Cyber Force reportedly attacked Palestinian targets including the Hamas website and Palestine National Bank. The activity marked spillover beyond local actors directly tied to Israel and Gaza.
Multiple hacktivist groups, including Garnesia Team, ACEH Hackers Group, Team Herox, Ganosec Team, and KEP Team, claimed attacks on Israeli government and commercial websites. The activity reflected a widening set of opportunistic and politically motivated actors joining the conflict.
Hacktivist actors promoted coordinated pro-Palestinian cyber campaigns under banners including #OpIsrael and OpsRise. These operations focused on Israeli online infrastructure and helped broaden the conflict's cyber dimension.
The Israeli Red Alert missile warning application was reportedly targeted in a cyberattack during the early days of the conflict. Anon Ghost was cited in reporting as claiming involvement.
The Jerusalem Post suffered cyberattacks that disrupted access to its website. Anonymous Sudan was reported as claiming responsibility for the attack.
Following the outbreak of the Israel-Hamas war, hacktivist groups aligned with both sides began launching cyber operations tied to the conflict. Reporting describes a rapid escalation into DDoS attacks, website defacements, data leaks, and disruptive campaigns against Israeli and Palestinian targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cyfirma.com
Open sourcepolitico.com
Open sourcebusinessinsider.com
Open sourcecyberscoop.com
Open sourceweb.archive.org
Open sourcethe420.in
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Following recent U.S.-Israeli kinetic strikes on Iranian targets, reporting indicates a spike in cyber activity tied to the **#OpIsrael** campaign, including collaboration between Iran-linked operators and pro-Russia hacktivist groups targeting organizations in the U.S., Israel, and the broader region. Activity cited includes **DDoS** operations attributed to Iran’s **Cyber Islamic Resistance** working alongside **NoName057(16)** against an Israeli defense contractor and municipal entities, plus additional claimed intrusions against Israeli organizations and a wider set of targets (including a Pennsylvania town and various educational entities abroad) associated with groups such as **FAD Team**. FortiGuard Labs assesses that, despite heightened concern about state-directed retaliation, there is **limited evidence so far of a large-scale, coordinated Iranian cyber response** directly tied to the strikes. Instead, observed activity is characterized as a surge of *loosely affiliated hacktivism* and “geopolitical noise,” including defacements, opportunistic intrusion attempts, broadcast/media disruptions, internet connectivity issues inside Iran, and increased Telegram-based claims of attacks across the region; FortiGuard notes there is **no confirmed evidence** at this time of destructive Iranian **wiper** campaigns or large-scale retaliatory critical infrastructure attacks, while warning the risk could escalate based on historical patterns.
Jun 29, 2026
Hacktivist activity has increased as tensions involving the United States, Iran, and Israel intensify, according to Sophos threat research. The reported campaigns indicate a rise in politically motivated cyber operations tied to the regional conflict, with threat actors using disruptive and influence-focused tactics to target organizations and amplify geopolitical messaging. The activity reflects a broader pattern in which international crises quickly spill into cyberspace, raising the risk of website defacements, distributed denial-of-service attacks, and other opportunistic intrusions against public- and private-sector targets. Sophos said the escalation underscores the need for organizations with exposure to the region or to politically sensitive sectors to monitor for hacktivist threats and strengthen defensive readiness.
Jun 29, 2026
Cyber activity surged immediately following joint **U.S.–Israel strikes on Iran** (described as *Operation Epic Fury*), with reporting indicating a fast-moving “cyber swarm” of hacktivists and aligned collectives conducting disruption, influence messaging, and broad cyber claim activity within hours of the kinetic events. A day-by-day Telegram-focused timeline described early **DDoS campaigns against Israeli government sites** expanding into a wider coalition of **pro-Iranian, pro-Palestinian, and Russian-aligned** groups targeting additional regions and sectors, including Gulf states, Europe, and the U.S., with increasing attention on **critical infrastructure**; examples cited include claims of DDoS disruption against Israeli commercial, defense-adjacent, and energy-related entities (e.g., an oil company and an advanced defense firm), sometimes accompanied by third-party availability “verification” links. U.S. state and local governments were separately warned by **MS-ISAC** to expect heightened “low-level” activity—particularly **DDoS**—in the wake of the Iran-related escalation, and were urged to harden internet-facing and cloud services (e.g., remediation of critical/cloud infrastructure, use of firewalls/CDNs, and reducing exposed employee/organizational data). In parallel, a critical-infrastructure-focused interview tied to an upcoming OT security summit reiterated that energy, water, pipeline, and ICS environments face persistent probing by state adversaries and that “low-cost entry” cyber operations can be used to test and disrupt mission-critical systems; while not specific to the Iran conflict, it reinforces the broader risk context for OT operators amid heightened geopolitical tensions.
Jun 29, 2026