Israeli Websites Hacked: ‘Be Ready for a Big Surprise’

TEL AVIV – Over one thousand Israeli websites were reportedly targeted Thursday morning in a cyberattack in which homepages were replaced with an anti-Israel video and message in broken Hebrew and English: “The countdown of Israel destruction has begun since a long time ago.”

Israeli media first reported that Iran was likely behind the attacks in retaliation for a massive cyberattack attributed to Israel on an Iranian port.

However, some experts have dismissed the theory, saying the attacks were part of an ongoing series of similar hacks marking Quds Day, an annual anti-Israel event first initiated by Iran.

"תתכוננו להפתעה גדולה": זה הסרטון שהושתל בעמודי הבית של האתרים שנפרצו במתקפת הסייבר ממדינות מוסלמיות @Shira_HN pic.twitter.com/0ANjMizCvi

— כאן חדשות (@kann_news) May 21, 2020

“Defacement attacks are considered the lowliest type of hacks and there exists a range of automated tools to deflect them. There is little technical knowledge needed to conduct them and often they are carried out by teenagers,” cybersecurity expert Noam Rotem told Calcalist.

“Such attacks have little value beyond propaganda and should be taken in proportion. There is very little likelihood that this rudimentary attack is part of a significant, state-backed effort.”

The hacks targeted several major firms and political groups as well as smaller businesses.

The page title said “Be Ready for a Big Surprise” in Hebrew.

A video showed bombs being detonated in Tel Aviv and a bloodied Prime Minister Benjamin Netanyahu swimming away from a burning city. It also showed Jerusalem, with thousands of Muslims praying on the Temple Mount.

“Israel won’t survive the next 25 years,” reads a message in Hebrew at the end.

Visitors to the click-thru sites were asked permission for access to their cameras.

Lotem Finklestein, a threat intelligence expert  from cybersecurity firm Checkpont, said the cyberattacks were likely a coordinated effort by a network of hackers in Muslim countries including  Turkey, North Africa and the Gaza Strip. “All the sites seem to be hosted on the same cloud server, which was apparently the breach point,” he said.