Iran is a cyber threat to the entire world and continues to attack nations across the globe, including Israel, at a rate three times higher than before Hamas’s Oct. 7 massacre, the head of Israel’s National Cyber Directorate said on Tuesday.
Gaby Portnoy, director general of the directorate, said that Iran was targeting countries including the United States, Canada, Saudi Arabia, Oman, the United Arab Emirates, India, the United Kingdom, Germany, Australia, Austria and more.
Speaking at the annual Cyber week conference at Tel Aviv University, Portnoy said that Iran was also attacking its own allies.
“We have identified that Iran is attacking its allies and other countries for information extortion and damaging digital services. The information stolen from government systems is then used for Iranian cyber-terrorism,” he said. “Iranian cyber aggression is an international problem, not only an Israeli one, and therefore the solution needs to be international,” he added.
Portnoy named several Iranian-linked hacking groups such as the Albania-based Homeland Justice and Imperial Kitten, operated by the Islamic Revolutionary Guard Corps.
Since Hamas’s Oct. 7 massacre, Tehran has expanded cyberattacks on Israel, including “crossing humanitarian red lines, such as the thwarted attack on Ziv Hospital in Safed,” said Portnoy.
“Iran’s actions constitute a complete violation of international privacy laws and conventions, causing worldwide damage to innocent civilians,” he added, calling for a global defense alliance to deter as well as exact a price from Iran for the damage the mullahs have caused.
Iran’s online disinformation activities and cyberattacks on Israel have risen dramatically since Oct. 7, according to a Microsoft report released earlier this year.
“As the war progressed, Iranian actors expanded their geographic scope to include attacks on Albania, Bahrain and the USA. They also increased their collaboration, enabling greater specialization and effectiveness,” said the report.
These cyberattacks grew “increasingly targeted and destructive” and so-called influence operation campaigns “increasingly sophisticated and inauthentic,” involving networks of social media “sockpuppet” accounts, it added.
Tehran’s four-pronged approach includes exacerbating domestic political and social rifts in target countries, cyberattacks against Israeli infrastructure in “retaliation” for the war in Gaza, intimidating Israeli supporters and their families and undermining international support for Israel.
The report also highlighted a new Iranian trend of hackers masquerading as Israelis.
In March, an Iranian hacker group claimed to have breached the Dimona nuclear facility in the Negev desert. The hackers claim to have stolen thousands of PDF documents, including invoices, email correspondence, Excel tables, Word documents and PowerPoint presentations.
