Yet Another Diminishing Spark: Low-level Cyberattacks in the Israel-Gaza Conflict

2025-04-22

AI Summary

This study empirically examines the dynamic characteristics of web defacements and DDoS attacks launched by low-tier cyber actors during the initial phase of the Israel–Gaza conflict (following Hamas’s October 2023 attack). Employing a mixed-method approach—including network traffic monitoring, dark web forum crawling, comparative analysis of compromised website snapshots, and sentiment analysis—we identify three key patterns: (1) sharp, short-lived attack surges peaking 1–3 days after major military events; (2) rapid decay within weeks; and (3) extreme asymmetry, with over 90% of observed attacks targeting Israeli entities and fewer than 5% directed at Palestinian ones. Systematic cross-conflict comparison reveals that these activities were markedly smaller in scale than those observed during the early phase of the Russia–Ukraine war, exhibited more extreme ideological polarization, and introduced a novel phenomenon: politically motivated defacement of third-country websites as symbolic alignment. The findings uncover a “flash-in-the-pan” modality of non-state actor cyber operations in geopolitical conflicts and elucidate their function as performative, symbolic political expression.

Technology Category

• Application Domains: Humanities & Computational Social Science
• Data Mining & Knowledge Management: Web
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Social Networks and Social Media: Media and governance, opinion dynamics, filter bubbles, polarization

Abstract

We report empirical evidence of web defacement and DDoS attacks carried out by low-level cybercrime actors in the Israel-Gaza conflict. Our quantitative measurements indicate an immediate increase in such cyberattacks following the Hamas-led assault and the subsequent declaration of war. However, the surges waned quickly after a few weeks, with patterns resembling those observed in the aftermath of the Russian invasion of Ukraine. The scale of attacks and discussions within the hacking community this time was both significantly lower than those during the early days of the Russia-Ukraine war, and attacks have been prominently one-sided: many pro-Palestinian supporters have targeted Israel, while attacks on Palestine have been much less significant. Beyond targeting these two, attackers also defaced sites of other countries to express their war support. Their broader opinions are also largely disparate, with far more support for Palestine and many objections expressed toward Israel.

Problem

• Analyzing low-level cyberattacks during Israel-Gaza conflict
• Comparing attack patterns to Russia-Ukraine war aftermath
• Examining one-sided cyberattack trends and hacker community dynamics

Innovation

• Quantitative measurement of cyberattack surges
• Comparison with Russia-Ukraine war patterns
• Analysis of one-sided attack dynamics