Joining the chaos: why hacktivists take sides

Fighting for a higher purpose or joining the chaos? With hundreds of cyber gangs jumping into the digital battlefield, questions around meaning and motivation arise when choosing which cause to fight for.

Hackers seem to be on the pulse of world events, constantly joining various causes to express their own position. Some appear to base their choices on what to fight for on ideological motives, while others simply engage when political events or conflicts arise. A third category may align with the political objectives of authoritarian regimes.

Since the violence erupted once again on the soil of Israel and Palestine, the cyber war has intensified too, with numerous hacktivist groups launching cyber attacks against Israel or Palestine’s digital infrastructure.

FalconFeeds has identified around 100 active groups currently participating in the ongoing cyber war, with 20 groups supporting Israel and 77 pro-Palestinian groups.

Some of them seem to be consistent with their goals, and the side they choose doesn’t come as a surprise. In contrast, others seem to merely embrace the chaos.

Multiple attacks against Israel and Palestine

So far, there have been a multitude attacks reported, targeting various Israeli organizations. Anonymous Sudan, a gang probably more connected with Russia than with Sudan, attacked The Jerusalem Post website and claimed to have targeted Israel’s air defense system, the Iron Dome. AnonGhost exploited an API vulnerability in the RedAlert app that provides real-time rocket alerts for Israelis.

Killnet, a Russian hacker gang, claims to stand against Israel and has launched distributed denial-of-service (DDoS) attacks against Israeli government websites.

Not every gang opted to attack Israel. Cybernews research revealed that Industrial control systems (ICS) are intensively targeted on both sides and have vulnerabilities that threat actors can easily take advantage of.

Indian hackers seem to have taken the other side. “Msg to Palestinian Terrorists: If you consider yourself a true man, Fight with Real Men face to face instead of hiding behind the shield of women and kids like you Terrorists always do,” tweeted the Indian Cyber Force, claiming attacks on Palestinian government web services.

A poll to decide on which side to pick

Some gangs, such as ThreatSec, have not taken a side. This gang claims to be attacking both sides alike for reasons that appear to be ideological.

“As you might know, we don't like Israel, but… We also don't like war! Soooo, as we have attacked Israel in the past, we now attack the Gaza region, where many of the Hamas fighters are located!” the gang wrote on Telegram, claiming that it had shut down nearly every server owned by internet service providers in the Gaza Strip.

Other gangs, like Cyb3r Drag0nz and Russian Cyber Army, posted a poll on their communication channels to let members decide which side to pick. This shows that there are groups that don’t have a strong opinion but are still willing to join the fight.

Chase Norlin, CEO of cybersecurity firm Transmosis, says that supporters of Israel and Palestine have been attacking each other in the digital realm for a long time already.

“The recent news exposes and amplifies that. There are resources on both sides to stage these types of cyber attacks, and under the context of war, they become more visible and relevant,” Norlin told Cybernews.

“Cyber attacks and espionage are a constant in the world today, happening behind the scenes across the globe. These attacks gain greater resources and momentum during times of war.”

Different agendas

Hacktivists quite often join multiple activist groups with separate and different objectives. Some are motivated by long-standing ideological beliefs, while others act impulsively, inspired or infuriated by a particular event like an unexpected Hamas attack on Israel.

“It is impossible to paint hacktivists with a broad brush. Hacktivism is a big tent word that can even include groups or actors who may work against each other’s goals,” geopolitical analyst Irina Tsukerman told Cybernews.

“Some simply enjoy the challenge and use political turmoil as cover to engage in their craft. Others only move when they are inspired by a particular event. While it is impossible to spell out the goals of hacktivists generally, it is absolutely safe to say that they can be a force to be reckoned with in modern technological warfare, especially because they typically operate outside of the government apparatus, giving them a great deal of leeway on their conduct.”

While many hacktivists are driven by their idealistic beliefs, for some, attacking organizations via different means is pure business. Some hacktivists seem not to be hacktivists at all but state-affiliated hackers instead. They’re allegedly either recruited by authorities or coordinate their actions with them.

Naturally, some people sowing chaos online are motivated purely by financial motives and will work for whoever pays them.

“Such movements can be loosely manipulated from within by various actors and occasionally switched sides depending on who takes the lead,” Tsukerman said.