Cyber threat actors linked with Hamas have seemingly ceased activity ever since the terrorist attack in Israel on Oct. 7, confounding experts.
Russia's invasion of Ukraine - preceded and supported by historic waves of cyber destruction, espionage, and misinformation - is, of course, the quintessence.
If today's playbook is to support resource-intensive kinetic war with low-risk, low-investment cyber war, Hamas has thrown out the book.
Failing to ramp up cyberattacks prior to Oct. 7 might be construed as strategic.
For a case study in what that looks like, take BLACKATOM - one of the three primary Hamas-linked threat actors, alongside BLACKSTEM and DESERTVARNISH. In September, BLACKATOM began a social engineering campaign aimed at software engineers in the Israeli Defense Forces, as well as Israel's defense and aerospace industries.
The ruse involved posing as employees of companies on LinkedIn and messaging targets with fake freelance job opportunities.
The false recruiters would send a lure document with instructions for participating in a coding assessment.
The fake coding assessment required recipients to download a Visual Studio project, masquerading as a human resources management app, from an attacker-controlled GitHub or Google Drive page.
Recipients were then asked to add features to the project, to demonstrate their coding skills.
Contained within the project was a function that secretly downloaded, extracted, and executed a malicious ZIP file on the affected computer.
Inside the ZIP: the SysJoker multiplatform backdoor.
'Nothing Like Russia' It may seem counterintuitive that Hamas' invasion wouldn't have been paired with a shift in its cyber activity akin to Russia's model.
This may be due to its prioritization of operational security - the secrecy that made its Oct. 7 terror attack so shockingly effective.
Less explicable is why the most recent confirmed Hamas-related cyber activity, according to Mandiant, occurred back on Oct. 4.
Hamas likely has not fully retired its cyber operations.
This Cyber News was published on www.darkreading.com. Publication date: Wed, 14 Feb 2024 00:05:22 +0000