Hackers attack Israeli hotel reservation sites

Iranian-linked threat group Sharp Boys allegedly hacked at least five Israeli hotel reservation sites.

“This connection is not private. This website may be impersonating “minihotel.co.il” to steal your personal or financial information. You should go back to the previous page,” reads minihotel.co.il website.

According to the threat intelligence feed DarkFeed, Sharp Boys also claim to have hacked isrotel.com, trivago.co.il, and danhotels.com websites, among others.

Sharp Boys allegedly stole the databases of the sites mentioned above, approximately 20,000 records.

Last week, Iran-linked hackers made headlines after false rocket warning sirens in Jerusalem and Eilat were likely caused by a cyberattack.

The chief of Israel National Cyber Directorate (INCD), Gaby Portnoy said that Iran had become Israel’s dominant rival in cyber, the Jerusalem Post reported. “We see them, we know how they work, and we are there,” Portnoy said.

Iran-backed threat actors reportedly target Israeli companies. According to the recent Microsoft blog, Lebanon-based threat actor Polonium, likely coordinating its attacks with Iran, has been targeting Israeli defense and critical manufacturing organizations.

Microsoft said Polonium’s tactic follows an increasing trend by many actors, including several Iranian groups, of targeting service provider access to gain downstream access.

“In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to access the targeted networks,” the blog reads.

The threat actor has targeted or compromised more than 20 organizations in Israel and one intergovernmental organization with operations in Lebanon over the past three months.

On Tuesday, Israeli prime minister Naftali Bennett warned that Iran would “pay the price” if it interferes with Israeli cyberinfrastructure, the Jerusalem Post reported.

https://twitter.com/Jerusalem_Post/status/1541695324451905537?s=20&t=fJ0LYSlMfnyigOOKbZgHTQ