Cybersecurity plays a critical role in geopolitics — particularly during times of conflict. While offensive cyber operations have become nearly universal, the tactics, timing and objectives of threat actors can differ greatly. With Russia’s invasion of Ukraine, for example, we observed and shared our report on how cyber tactics can be used to support military action.
In our latest report, Tool of First Resort: Israel-Hamas War in Cyber, we share our findings on a different tactical approach — and the escalation in offensive cyber operations in the wake of the October 7 terrorist attacks. Notably, after the terrorist attacks by Hamas, we observed the steady stream of cyber operations by Iran and Hezbollah-linked groups become more focused, more concentrated, and — among other objectives — geared toward undercutting public support for the war.
Today’s report offers the latest example of how cyber operations are tools of first resort, providing a lower-cost, lower-risk way for rivals to engage in conflict, gather information, disrupt daily life, and shape public perceptions — all while still remaining below the line of direct confrontation.
Google has been tracking and protecting users from cyber threat activity before, during, and after the Hamas terrorist attacks on October 7. Today’s report, based on analysis from Google’s Threat Analysis Group (TAG), Mandiant, and Trust & Safety teams, encompasses new findings on Iranian-government backed phishing campaigns, hack-and-leak and information operations (IO), as well as disruptive attacks targeting Iran and Hamas-linked cyber operations.