Iran backed hackers step up cyber ops in Israel Hamas war

Cybersecurity researchers at Google warn that cyber operations are increasingly used as a tool of first resort in the Israel–Hamas conflict, providing a lower-cost, lower-risk way to influence events. In the latest Tool of First Resort report, they note Iran and Hezbollah-linked groups have intensified and focused their operations after the October 7 attacks, including destructive actions, hack-and-leak campaigns, and information operations aimed at demoralising Israeli citizens and shaping global opinion.

The report also describes an actor claiming to be acting in response to the conflict, Gonjeshke Darande (Predatory Sparrow), which Iran has attributed to Israel, though there is insufficient evidence to evaluate those claims. Hamas-linked actors reportedly engaged in cyber espionage patterns prior to October 7, including mass phishing and mobile spyware, with activity diminishing since then.

The assessment contrasts the Israel–Hamas cyber landscape with the Russian war in Ukraine, predicting continued Iran-linked destructive attacks, IO and hack‑and‑leak operations in 2024, and potential resumption of Hamas activity focused on intelligence gathering. According to Google’s Threat Analysis Group, Mandiant and Trust & Safety, the findings come from analysis of new IOCs and campaigns published alongside the full report on 14 February 2024.