In the latest episode of cyberwarfare between the rival states, an Iran-linked hacking gang hit seven Israeli targets in a 24-hour span, according to an Israeli cybersecurity firm. The Israeli "government and business sector" were among the targets of the "Charming Kitten" attack, according to a statement issued late Wednesday by Tel Aviv-based Check Point.
"Check Point has blocked these attacks, as we witnessed communications between a server used by this group and the targets in Israel," said the firm. "Our reports of the last 48 hours prove that both criminal hacking groups and nation-state actors are engaged in the exploration of this vulnerability."
Charming Kitten, also known as Phosphorous, APT35, Ajax Security Team, ITG18, NewsBeef, and NewsCaster, is a threat actor that has been active since at least 2011 and has targeted entities in the Middle East, the United States, and the United Kingdom. FireEye classified the group as a nation-state-based advanced persistent threat on December 15, 2017, despite its lack of sophistication. Research conducted by FireEye in 2018 suggested that APT35 may be expanding their malware capabilities and intrusion campaigns. Since then, the gang has been known to use phishing to spoof firm websites, as well as false accounts and DNS domains to steal victims' passwords.
Allegations of cyberwarfare between Iran and Israel have grown more serious in recent months. In October, Israel was implicated in a series of cyberattacks on Iranian infrastructure, including the country's fuel distribution system. The disruption had an unusual impact because it shut down the IT system that allowed Iranians to fill their tanks for free or at reduced prices using a digital card issued by the authorities.
Another reportedly Iran-linked hacker organization, "Black Shadow," claimed responsibility for a cyber-attack on an Israeli internet service provider in October. One of the sites targeted in that incident was Israel's largest LGBTQ dating service, with the hackers demanding ransom payments in exchange for sensitive private information such as the HIV status of the site's users.
According to the finance ministry, Israel, which prides itself as a cybersecurity leader, hosted a "international cyber financial war game" last week. The United States, Britain, and the United Arab Emirates, which established diplomatic ties with Israel last year, were among those who took part. Germany, Switzerland, and the International Monetary Fund were all present, according to the ministry. Shira Greenberg, a chief economist at Israel's finance ministry, said the exercise underlined "the importance of coordinated global action by governments and central banks in the face of cyber-financial threats."
