A new study published by academics at the U.K.’s University of Cambridge details just how online vigilantism has played out since Hamas militants from Gaza attacked southern Israel on October 7, killing at least 1,400 people and taking some 200 hostages, most of them civilians.
Ross Anderson and his coauthors, Anh V. Vu and Alice Hutchings, analyzed a database of cyberattacks worldwide that they already monitor regularly in the two weeks before, and one week after, October 7. In all, they discovered 8,659 cyberattacks took place over the three-week period, around 536 of which were linked to the Israel-Hamas war.
The overwhelming majority of those cyberattacks (531) were launched against Israeli targets—often business websites registered with a .co.il domain name. The number of attacks leaped from nearly zero in the weeks before October 7 to 95 two days later (shortly after Israel officially declared war against Hamas). Ten of the most frequent attackers accounted for 79% of all the attacks against Israeli websites, which left web pages defaced with messages and hashtags such as #opisrael, #freepalestine, #savepalestine, and #savegaza. Many attacks targeted businesses and nonmilitary websites, though at least one cyberattack was successfully waged against a subdomain of the Israel Defense Forces.
As the war has continued, attacks have flared up in parallel with events on the ground. Some 20 cyberattacks were recorded on October 17, in the immediate aftermath of an explosion at the Al-Ahli Arab Hospital in Gaza. Such spikes buck the broader trend of a diminishing number of attacks day after day, which suggests a waning interest in participating in cybervigilantism.
“I suspect that many of these defacements of Israeli websites are just basically random kids around the world,” Anderson says. “Youth culture tends to be more pro-Palestine than pro-Israel.”
Anderson’s department tracked something similar in the immediate aftermath of Russia’s invasion of Ukraine in 2022, when the so-called Ukrainian IT Army, a ragtag bunch of individuals (not all of whom are Ukrainian) began launching nuisance attacks against Russian IT infrastructure. In the Russia-Ukraine war, initial interest in launching attacks against Russian websites across business and government quickly diminished as people who didn’t have a strong connection to the belligerents apparently grew bored of tracking developments.
Anderson suggests it’s likely more attacks have been waged against Israeli websites than Palestinian-linked ones because of the hackers’ demographics. Part of the Cambridge Cybercrime Centre’s research focuses on the various pathways into criminal behavior on the internet. One hypothesis states that kids begin to learn how to cheat at video games, then create their own, before eventually moving on to write malware. “As they learn their trade, they become more capable and more dangerous,” he says.
However, Anderson adds, many people now pick up their cybercrime habit from incel communities, which are often teeming with both misogyny and antisemitism. “If you spent a few years whining your face off about your inability to get a girlfriend, you may end up hanging out in places where there’s lots of explicitly Nazi people saying, ‘It’s all the Jews’ fault,’” he says.
Alan Woodward, a cybersecurity professor at the University of Surrey in the U.K. who was not involved in the research, says part of the disparity between the number of attacks against Israeli- and Palestinian-linked websites could be owed to the fact that there are simply many more of the former. But the number of sites defaced in Israel surprises Woodward. “Israel has a reputation for being well defended in cyberspace,” he says. “It’s notable that the attacks seem to emanate from centralized sources—a small collective is doing this.”
Woodward posits that it’s possible a third-party nation is attacking the sites in support of and on behalf of those supporting Hamas. “The usual suspects who have an interest in disrupting Israel come to mind,” he says. However, it’s equally plausible that the hackers are everyday citizens who want to show their displeasure at how Israel has responded to the Hamas attacks. “These types of [cyber]attacks are not technically difficult, they just require coordination,” he says.
Anderson is less certain that there’s much rhyme or reason behind the attacks, nor any sort of centralized control by a nation state. “This is not strategic cyber stuff,” he says. “This is petty cyber criminology.”
