The Media Line: Tools of War: Tackling Cyberbreaches in Middle Eastern Warfare 

Audio By Carbonatix

Enlarge

Tools of War: Tackling Cyberbreaches in Middle Eastern Warfare 

Cyberattacks targeting Israeli civilians and military systems reveal how digital pressure campaigns have become an integral part of today’s regional conflict 

By Keren Setton/The Media Line 

Instead of updates about upcoming buses, passengers at a central Israel bus station last week suddenly heard Arabic messages cursing Israeli Prime Minister Benjamin Netanyahu and US President Donald Trump. The incident, reported by Israeli media and confirmed by the signage company, turned a routine commute into an unsettling reminder of how easily digital systems can be hijacked. 

The recording then shifted into a Muslim prayer, layered with siren-like sound effects. Reports from other bus stations said similar audio had been broadcast there as well. 

Authorities suspect the digital signage system was hacked from a “hostile country.” The episode showed how modern warfare is no longer confined to physical battlefields and can seep into daily life through low-cost digital sabotage, exposing the vulnerabilities of highly networked economies and societies. 

Israel’s National Cyber Directorate says the country has experienced a sharp rise in cyberattacks since the war in Gaza began in October 2023. According to its data, most attempts were thwarted, and essential services continued to operate. 

Israeli media also reported last week that the military has begun phasing out leases of Chinese-made electric vehicles used by senior officers, because of concerns that software in the cars could enable Beijing to collect intelligence on the Israel Defense Forces (IDF). 

Another report said the IDF plans to make iPhones mandatory and ban Android phones for senior officers, out of concern that the latter are more vulnerable to breaches. 

In response to a request for comment by The Media Line, the IDF said, “The move is driven by considerations of classified information and is in advanced stages of evaluation,” referring to both the possible ban on Android-based phones and the use of vehicles manufactured in China. 

“A common denominator of all of these is that Israel’s enemies are having difficulty undertaking direct cyberattacks against critical infrastructures, so they are targeting the supply chain,” a senior figure in Israel’s cybersecurity industry, speaking on condition of anonymity, told The Media Line. According to him, most of the attacks during the war were carried out by “kids with access to a computer,” and the bus signage hack was relatively simple to pull off without prior advanced knowledge. 

“The intent is to scare and sow fear,” Dr. Hemi Leibowitz, head of cybersecurity at the Faculty of Computer Science at the College of Management, told The Media Line. 

The war between Israel and the Hamas terrorist organization, which quickly spilled over into a regional conflict, followed soon after the outbreak of the war between Russia and Ukraine. 

“Whatever happened in Ukraine, happened tenfold in Israel,” the senior figure said. “This was especially true in the realm of deep fake and cybersecurity. In the past, there were specific dates when cyberattacks were coordinated; in the war, it was just nonstop. Most of the hackers are low-level, and their successes are limited.” 

Campaigns like OpIsrael or OpJerusalem, once coordinated waves of attacks against Israeli websites and services using ransomware and other tools, became almost obsolete as attempts to infiltrate systems started occurring on an almost hourly basis. 

The conflict did trigger a spike in hacktivist activity. Still, it did not escalate into a large-scale, sustained cyberwar, suggesting there are limits to how much disruption nonstate actors can cause in cyberspace during a high-intensity conflict. 

Hamas, a terrorist organization funded by both Qatar and Iran, is believed to have cyber capabilities that it used against Israel even before the current war. Defense experts and think tanks assess that Hamas uses cyber operations not only for espionage or sabotage but also to run information campaigns—defacements, leak-and-dump operations, propaganda dissemination, social media manipulation, and, perhaps most prominently, psychological warfare. 

That approach fits a broader global pattern of nonstate actors turning to cyber tools as a cheaper, lower-risk way to project power and shape narratives alongside conventional terrorist attacks. 

“Israel often regarded Hamas as a simple organization, but it was very successful in surprising Israel, likely cooperating with other enemies of Israel such as Iran,” said Leibowitz. 

The Gaza-based group is believed to have monitored Israeli soldiers’ social media accounts for years, collecting information about their movements, bases, and routines. This trove of data helped Hamas design the surprise attack it carried out to Israel’s shock in October 2023. 

Israel’s Army Radio reported last week that the IDF is preparing to deploy an artificial intelligence system dubbed “Morpheus” to monitor soldiers’ social media accounts and flag potential breaches and leaks. 

The IDF declined to comment on the system. 

During the war, hackers also tried several times to break into major hospitals in Israel. 

“This is terrorism par excellence and is executed by state actors that are cyber-superpowers,” the senior figure explained. 

Investigators believe confidential patient information was compromised in some cases, but core hospital operations continued without interruption. One attack on a medical center in northern Israel forced the hospital to temporarily revert to paper records. 

“The extent of the damage is never fully revealed by those who have been targeted,” said Leibowitz. “We also do not know if the attackers carried out some sophisticated attack or simply had luck.” 

Israel’s National Cyber Directorate confirmed that one of the attacks, in late 2023, was carried out by Iran. The Islamic Republic never responded to the accusation. 

Officials in Israel also accused Iran of attacking the Technion – the Israel Institute of Technology, in what was considered a major ransomware assault. 

Information warfare, disinformation, and efforts to wield influence in the digital arena have proven nearly as important as conventional military power. 

Both sides in the conflict have tried to steer the narrative through social media, deploying deepfakes, online propaganda, and manipulated images, turning cyberspace into a battleground that is almost on par with physical combat. 

“The breakthrough in artificial intelligence [AI] came at a bad time for Israel,” the senior cybersecurity figure added. “This was evident in the world of fake news, especially.” 

AI-driven disinformation flooded social networks at a scale that overwhelmed traditional monitoring systems, blurring the line between verified reporting and fabricated content. 

“Israel is the most challenged and threatened country in this arena,” said Leibowitz. “It has made a lot of efforts to combat this and, as a whole, made a lot of progress, with statistics showing that most of the attacks are thwarted. But this is a never-ending race, and Israel needs to stay on top at all times.”