Arab and Muslim Hacking Groups Again Aim To Attack Israeli Cyberspace, In #OpIsraelBirthday, Set For April 7 – With Participation Of AnonGhost, Anonymous, Syrian Electronic Army (SEA), Qassam Cyber Fighters

April 7, 2014

On April 6, 2013, a coordinated cyberattack, dubbed #OpIsrael, was launched by number of hacktivists from across the world against Israeli cyberspace; participants included members of the hacker collective Anonymous. While the attack was aimed at causing widespread damage, Israeli media reported that it had had very little impact.

The planned attack was announced several months in advance and was promoted largely via social media.

Announcements of the 2014 version of the event, named #OpIsraelBirthday and set for April 7, 2014, began circulating online in January 2014. The well-known hacking team AnonGhost is taking a leading role in promoting this year’s attack, including on its Twitter accounts; it has stated that the operation would target every possible Israeli website to show solidarity with Palestine,[1] and has given interviews on the subject. Like last year’s operation, this year’s too is currently being promoted on social media worldwide. This year’s participants include the Syrian Electronic Army (SEA), Qassam Cyber Fighters, and more.

The date of #OpIsraelBirthday, April 7, was reportedly set to coincide with Israel’s Independence Day;[2]  however, this year the holiday falls on May 6. Last year’s OpIsrael was timed to take place on Israel’s Holocaust Remembrance Day, and the website of Israel’s Yad Vashem Holocaust memorial was among those that came under attack.

OpIsraelBirthday.com

The operation’s official website, opisraelbirthday.com, prominently features AnonGhost’s name, and states that it was designed by “Mauritania Attacker.”  It features an “Official Video of #OpIsrael Birthday” and a scrolling list of “Israel Web Under Attack – Till Now 478 [as of this writing] Websites Has [sic] Been Breached By AnonGhost Team.” Scrolling across the top is a list of allegedly hacked Israeli websites – though at the time of this writing the only one noted was that of Israel’s Ministry of Agriculture.

 
Opisraelbirthday.com, accessed April 4, 2014.  

The website is registered to one “Kay Martin,” whose email address is given as [email protected] – AnonSec is another group behind #OpIsraelBirthday; MEMRI was unable to confirm this person’s contact information as genuine. Additionally, the area code of the telephone number provided is the source of a great many scam phone calls.[3]

Domain Name:

Registry Domain ID: 1850804588_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.godaddy.com Registrar URL: http://www.godaddy.com

Update Date: 2014-03-17 09:14:16 Creation Date: 2014-03-17 09:14:16

Registrar Registration Expiration Date: 2015-03-17 09:14:16 Registrar: GoDaddy.com, LLC

Registrar IANA ID: 146

Registrar Abuse Contact Email: [email protected]

Registrar Abuse Contact Phone: +1.480-624-2505

Domain Status: clientTransferProhibited Domain Status: clientUpdateProhibited

Domain Status: clientRenewProhibited

Domain Status: clientDeleteProhibited

Registry Registrant ID:  Registrant Name: Kay Martin

Registrant Organization:

Registrant Street:

228 grays lane

Registrant City: Elizabethtown Registrant State/Province: North Carolina

Registrant Postal Code: 28337 Registrant Country: United States Registrant Phone: +964.4454545

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: [email protected]

Registry Admin ID:

Participants In #OpIsraelBirthday

Another scrolling list on the OpIsraelBirthday website names hacking groups that are allegedly participating in the attacks. The list reads:

AnonGhost

Anonymous

SEA

Izz ad-Din al-Qassam Cyber fighters

Mauritania HaCker Team

AnonSec

ZHC

X-Blackerz INC.

Xploiter

Team Hacking Argentino

Pakistian Haxors Crew ( PHC )

Egyptian Shell Team

Gaza Hacker Team

Fallaga

Indonesian Cyber Army

Indonesia Fighter Cyber

Anonymous Syria

Anonymous Malaysia

Anonymous Tunisia

Anonymous Algeria

Anonymous Jordan

Anonymous Lebanon

And More etc…

“The completed Teams List Will be Updated Before the 7ith April.”

It is interesting to note that no official Iranian hacking groups are listed as participating in the attack, and that both the Syrian Electronic Army (SEA) and the Qassam Cyber Fighters have Iranian and Russian connections. It is also notable that SEA is working together with Anonymous Syria, since they are on opposite sides in Syria’s ongoing civil war. Also, the “Izz ad-Din al-Qassam Cyber fighters” listed above are thought to be an Iranian front group (see MEMRI Inquiry & Analysis No. 1017, The Rise And Fall Of The Qassam Cyber Fighters: Arab Hacking Group or Iranian Cyber Front? A Review Of Its First Year Of Activity – September 2012-September 2013). No activity by this group has been reported for over six months.

Earlier, in January 2014, it was announced that a number of other hacking teams were also involved in #OpIsraelBirthday.[4]

#OpIsraelBirthday On Facebook – You’re Invited, How Will You Attack Israel?

The OpIsraelBirthday’s Facebook page was launched March 2, 2014 with the location given as “Palestine, Texas.”


Facebook.com/OpIsraelBirthday, accessed April 4, 2014.


Facebook.com/OpIsraelBrithday/info

According to the Facebook event announcement, 2,000 people are “going,” with 220 “maybes”; 9,000 have been “invited” to participate.


Facebook.com/events/229401213930340

A post on the page surveys readers about what they will do in #OpIsraelBirthday, offering the options “DDOS,” “Leak, Deface, DDOS, Spam email and phone,” and “Deface.”

 
AnonGhost Promotes #OpIsraelBirthday On Twitter

AnonGhost actively maintains a Twitter account (@An0nGhost) with numerous current posts about OpIsraelBirthday.

In a March 29 tweet, AnonGhost announces “Israel Web Under Attack By AnonGhost”  and provides a Pastebin link, and in another on the same date it posts a link to a story about its hack of the Israeli Ministry of Agriculture website. An earlier tweet directs followers to an #OpIsraelBirthday Blogspot account and urges them to spread the word.

In a March 2014 interview, an AnonGhost representative said that the team “was the first team who announced the cyberwar on israel with the participation of many hackers around the world and anonsec hackers are the best of them. for the next opisrael we are targeting gov website civilian website social media everything.”

Addressing “Israhell,” he said: “[Y]ou call us terrorist and we are proud to be terrorist but we wont stop hacking defacing leaking exposing your pigs, there is no israhel its only Palestine.” He also noted that the group has “handled many operation: opisrael, opisrael reborn, oppetrol, opburma, optrollisrael and one op against opislam lunched by israhel.”[5]

AnonSec On #OpIsraelBirthday: Our Group’s Threatened By FBI

In a March 2014 interview, an AnonSec representative said that the upcoming #OpIsraelBirthday will include “Leaking Personal Datas/Spamming Emails/Spamming Cell phones/Leaking Websites/Leaking Emails and password/Defacing/DDOS Attacks/And Maybe Publish hacked websites and gov.”

He noted that the group was threatened by “f.b.i,or from any cyber security” and added “israeli hackers are kids and noobs, if they were real hackers they would patch their shitty security by now lol, we’re laughing at their security since 2012//.”[6]

Afghan Cyber Army Promotes #OpIsraelBirthday

As it did last year, the Afghan Cyber Army (ACA) hacktivist group is also promoting #OpIsraelbirthday. It stated on its Facebook page: “Millions of Martyrs March Toward Jerusalem/Banish the sleep from the eyes of all Jews/Come on, You Lovers of Martyrdom, You are all Hamas…We shall pray in Jerusalem InshAlllah, or else we shall die as Martyrs on its threshold.”

 

Endnotes:

     

[1] Hacking News, January 20, 2014.

[2] Hacking News, January 20, 2014.

[3] 800notes.com/AreaCode.aspx/1-964

[4] They include, according to the report: Mauritania Attacker, Virusa Worm, Deto Beiber, Dr.SaM!M_008, M3GAFAB, Extazy007, PhObia_PhOneyz, Mr Domoz, Tak Dikenal, AnonxoxTN, Raka 3r00t, PirateX, Bl4ck Jorozz, Younes Lmaghribi, Indonesian r00t, BlackBase Hacker, CoderSec, h4shcr4ck, Mrlele, Donnazmi,  TheGame Attacker, Man Rezpector, SaccaFrazi, Spec Tre, HusseiN98D,  HolaKo, Mr.Ajword, Root Max, Egy Eagle, THE GREATEST, BiosTeRminat0r, Man Rezpector, Hani Xavi, Don Maverick, Psyco Hacker, Black Cracker, rummykhan, Root Max, VINUX, ARAFET, TITO_SFAXSIANO and SquiCk H4ck3r. Hacking News, January 20, 2014.

[5] Meethackers.in, March 2014

[6] Meethackers