Iranian hackers targeted dozens of Israeli websites on Thursday, as part of a coordinated attack mounted on the Islamic republic's Quds Day.
Among the sites downed were those of the City of Ramat Hasharon, Free Israel, KIA Israel, Regavim, United Hatzalah, and the Kinneret Authority, to name a few.
Follow Israel Hayom on Facebook and Twitter
Users trying to access the targeted website found that their content was replaced by images of Jerusalem, Tel Aviv and Haifa going up in flames, with a caption in broken Hebrew saying, "The countdown to Israel destruction has begun."
The National Cyber Directorate said that the attack was perpetrated by Iran or Hamas, both of which have previously done so on Quds Day.
Video: Courtesy of the Ramat Hasharon Municipality
Many of the sites targeted are hosted by "Upress." A statement issued by the company said, "We have detected a large-scale cyberattack on many of our sites. This is a deliberate and widespread attack by anti-Israeli elements.
"We have identified a security weakness in the WordPress plug-in that caused a breach and we are working with the National Cyber Directorate, conducting a security investigation, and addressing issued on all websites."
The company said it was working to repair the damage caused by the cyberattack, noting, "This is a very serious incident but we promise we'll get through it."
Lavy Shtokhamer, head of the computer emergency response team at the INCD, told Israel Hayom that, "The main purpose of these groups is to create media headlines; to create panic and fear by using attention-grabbing images and slogans.
"These are not very sophisticated attacks and they have only limited success each year, but the increased reliance on technology due to the coronavirus crisis has created a substantial platform that hackers can exploit," he explained. "
An official with Israeli cybersecurity giant Check Point Software Technologies said, "We are seeing an organization of hackers from the Muslim world (probably Turkey, North Africa, and the Gaza Strip) working to attack Israeli sites and replace their homepages with anti-Israeli images and slogans.
"As these sites are hosted by the same cloud service, it probably created a single point of failure that has hit multiple sites."
As for the Iranian issue, Check Point noted, "We see in this group nine attackers that have been active since April. A study of their profiles links them to Turkey, North Africa and the Gaza Strip. It doesn't mean that there aren't others, but we can't positively confirm Iranian activity at this time."
