Israeli Cyber Operations

Documentation of Israeli cyber warfare, sabotage operations, and surveillance technology.

Cyber Operations and Sabotage

Stuxnet (Discovered 2010)

The most sophisticated cyber weapon publicly known at the time of discovery, jointly developed by Israel (Unit 8200) and the United States (NSA) under the codename “Olympic Games”.

Target: Iran's Natanz uranium enrichment facility

Technical details: – Malware specifically designed to target Siemens SCADA systems controlling centrifuges – Caused centrifuges to spin at incorrect speeds while displaying normal readings to operators – Estimated to have destroyed 1,000-2,000 centrifuges (approximately 20% of Iran's total) – Set back Iran's nuclear program by an estimated 1-2 years

Discovery and spread: – Spread beyond intended target due to a programming error – Infected computers in multiple countries including Indonesia, India, Pakistan – Eventually discovered by security researchers in 2010 – Neither US nor Israel officially acknowledged involvement (confirmed by investigative journalism and leaks)

Key sources: – David Sanger's reporting in the New York Times – Documentary “Zero Days” (2016) – Snowden documents

Duqu (2011)

Flame/Flamer (2012)

Gauss (2012)

Other Alleged Cyber Operations Against Iran

Year Operation/Target Description
2012 Iranian oil ministry Malware attack disrupted operations
2020 Shahid Rajaee Port Cyberattack caused massive disruption (alleged retaliation for Iranian attack on Israeli water systems)
2021 Iranian rail system Attack displayed fake messages about delays, referenced Khamenei's office phone number
2021 Gas station payment systems Nationwide disruption affecting 4,300 gas stations
2022 Steel facilities Attacks on three major steel companies, caused fire at one facility

Lebanon Pager and Walkie-Talkie Attacks (September 2024)

One of the most unprecedented supply chain attacks in history, targeting Hezbollah communications devices across Lebanon and Syria.

September 17, 2024 – Pager Explosions: – Thousands of pagers exploded simultaneously across Lebanon – Devices were booby-trapped with explosives before delivery – Explosions occurred in Beirut, the Bekaa Valley, and southern Lebanon – Also reported in Damascus, Syria

September 18, 2024 – Walkie-Talkie Explosions: – Second wave of explosions the following day – Targeted walkie-talkies and other communication devices – Similar simultaneous detonation pattern

Casualties: – At least 37 killed (including civilians and children) – Approximately 3,000+ wounded – Many victims suffered severe injuries to hands, eyes, and faces – Injuries occurred in homes, shops, markets, and hospitals

How it was done: – Devices reportedly manufactured or intercepted in supply chain – Small amounts of explosive (PETN or similar) hidden inside batteries – Triggered remotely via coded message sent to all devices simultaneously – Operation required infiltrating manufacturing/distribution chain months in advance – Pagers were reportedly ordered by Hezbollah as a “secure” alternative to cell phones

The supply chain: – Pagers were Gold Apollo brand (Taiwan) – Gold Apollo stated devices were manufactured under license by BAC Consulting (Hungary) – Hungarian company was reportedly a front – Investigation traced shell companies across multiple countries – Demonstrated deep penetration of procurement networks

Civilian impact: – Devices exploded in public places, markets, hospitals – Medical workers, bystanders, and family members among casualties – Children killed and wounded – Amnesty International called for war crimes investigation – UN Human Rights Office expressed concern about indiscriminate nature

Israel's response: – No official acknowledgment – Israeli officials made oblique references suggesting involvement – Widely attributed to Mossad in international reporting

Legal and ethical concerns: – Booby-trap devices prohibited under Protocol II of Convention on Certain Conventional Weapons – Attacks in civilian areas raise questions of proportionality and distinction – Unprecedented nature of supply chain weaponization – Set potential precedent for future attacks on consumer electronics

Significance: – Demonstrated ability to compromise supply chains at manufacturing level – Years of planning and coordination required – Escalated Israel-Hezbollah conflict leading to expanded military operations – Raised global concerns about electronics supply chain security

Unit 8200

Israel's signals intelligence (SIGINT) unit, equivalent to NSA/GCHQ:

Pegasus Spyware (NSO Group)

While technically a private company, NSO Group has deep ties to Israeli intelligence and military:

Background: – Founded by former Unit 8200 members – Exports require Israeli Ministry of Defense approval – Spyware sold to governments worldwide

Capabilities: – Zero-click infection of smartphones (no user interaction required) – Complete access to device: messages, emails, photos, microphone, camera, location – Can extract encrypted messaging app data (WhatsApp, Signal)

Documented abuses: – Used to target journalists, human rights activists, lawyers, politicians worldwide – Jamal Khashoggi: Phones of associates/family targeted before his murder – Mexico: Targeted journalists investigating cartels and corruption – Saudi Arabia: Targeted dissidents – UAE: Targeted activists including Ahmed Mansoor – Hungary: Used against journalists and opposition figures – Poland: Used against opposition politicians – Spain: Used against Catalan independence figures – India: Targeted journalists and activists

2021 Pegasus Project revelations: – Investigation by 17 media organizations – Leaked list of 50,000+ potential surveillance targets – Led to diplomatic incidents and lawsuits – NSO Group blacklisted by US Commerce Department – Apple sued NSO Group

Israeli government involvement: – Sales used as diplomatic tool – Licenses reportedly granted/revoked based on foreign policy goals – Israel allegedly offered Pegasus to countries in exchange for diplomatic recognition