- Iranian cyber groups hit organizations in Israel with Advanced Persistent Threats (APT) set to last for long periods on stealth mode inside the victims’ networks.
- These special groups build custom-attack tools and take advantage of platforms like Telegram, WhatsApp, and LinkedIn to hit government and security entities.
- Organizations must devise proactive strategies to hunt threats, assuming attackers already have access to their networks.
Iran’s cyber group is hitting Israel with a stealth move, covering them up. The public only sees dramatic SMS warnings admonishing Israelis to update the “Home Front Command” application. But behind the scenes, there’s a sophisticated connection of state-backed hacking groups running surgical strikes on the infrastructure of Israel.
When Operation Roaring Lion commenced, Iran had numerous cyberattacks targeting Israel. One incident involved SMS messages sent to thousands of Israelis. These messages prompted users to update the Home Front Command application. Anyone who clicked such links became targets of Advanced Persistent Threats.
APTs represent highly targeted attacks where attackers focus on specific organizations or groups. They develop customized attack tools for each target. After breaching systems, these attackers remain inside networks for extended periods. At this moment, they keep an eye on emails, collect sensitive credentials, and carry out other malicious activities.
As a routine, individuals and organizations in Israel get hit by Iranian cyber groups. Most of these activities remain invisible to the public. Cybersecurity firm Mandiant introduced a numbering system for these groups several years ago. This system has become an industry standard.
Elite Iranian Groups Target Israeli Infrastructure
Each group that demonstrates a unique operational pattern receives a specific identification number. Several groups focus specifically on Israeli targets.
APT35 handles campaigns for sophisticated phishing targeting journalists and academic ventures in Israel. These attacks use carefully drafted emails to lure victims to websites that carry the malware. The sites extract information or run malware on the devices of the target.
APT42 utilizes familiar communication services like WhatsApp to gain entry. The group approaches security and government officials through these channels. Once the attacker compromises a victim, the malicious file injected into the computer establishes covert communication via platforms like Telegram and Discord.
With these services, it’s easy to create channels with encryption and untraceable communication. What the group does is use sophisticated tools to secretly take note of keystrokes, take screenshots, and hijack passwords the victim saved on their browser. After that, the tools transmit the harvest to attackers outside the organization.
APT34 has a bond with the Islamic Revolutionary Guard Corps. It primarily targets critical infrastructure and government organizations. All it’s after is to run a malicious backdoor program that links back to the infrastructure of the attacker. Security experts call it Command and Control (C2) servers because it lets attackers remotely manipulate the compromised machines.
Specialized Tactics Across Digital Platforms
These groups demonstrate remarkable specialization in specific sectors. They develop tailored attack mechanisms for each industry.
Groups focusing on aviation and critical industries use LinkedIn to distribute infected files. They target professionals working in those sectors specifically. Other groups targeting opponents of the Iranian regime concentrate on communities formed on platforms like Facebook. They utilize these services to profile and know who to target.
They invest a good effort in building sophisticated malware. According to security experts, these vulnerabilities are also zero-day exploits. Defense tools remain unaware of these threats. This makes detection and prevention far more difficult.
The threat isn’t limited to Iranian groups; pro-Russian hackers like Server Killers are also deploying sophisticated attacks, as seen in their recently claimed assault on Israeli banks, proving that Israel’s cyber defenses must contend with multiple state-sponsored adversaries simultaneously.
“Israel has been engaged in a continuous and intelligent cyber war for several years,” security researchers explain. “These operations surround us through almost every familiar digital platform.”
Organizations must have Proactive Defense Strategies
Contending with such threats needs more than ordinary awareness. Organizations must adopt robust information security strategies. They need to strengthen internal network defenses significantly. Reducing excessive access permissions becomes critical.
Security professionals recommend that organizations operate under a specific assumption. Assume that the bad actor is already inside the network. So, the defense tactic should focus on stopping further nefarious activity rather than just denying entry.
One advanced technique involves carrying out periodic threat hunts where security teams systematically search inside the network of the organization. They identify sneaky, malicious files ahead of a cyber incident.
The scope of the threat extends beyond simple network breaches. These operations surround Israeli organizations through almost every familiar digital platform.
