Thousands of Websites Defaced in Cyberattack Calling for the 'Destruction of Israel'

Hack into website hosting service's server comes a day before Iranian Quds Day, but no link to Iran identified

Ran Bar-Zik
Send in e-mailSend in e-mail
Screenshot of the video shown in affected websites, May 21, 2020.
Screenshot of the video shown in affected websites, May 21, 2020.Credit: Muli Bahr
Ran Bar-Zik

Thousands of Israeli websites, some of which belong to large companies, were defaced on Thursday morning after the servers of website hosting service uPress were hacked. Instead of their usual content, websites showed a video depicting the “destruction of Israel.”

The cyberattack, claimed by a group called Hackers of Saviour, brought down the company’s servers. Then, hackers altered a file on each site stored on uPress’s servers, allowing them to replace its content with the anti-Israeli video.

0:00
-- : --
Bibi swears in his colossal coalition and readies for a courtroom showdown Credit: Haaretz

Apart from defacing the websites, the attack isn’t said to have caused any further damage and no malware was detected. The hackers attempted to erase the websites’ data, but it remains unclear whether they succeeded in even gaining access to databases.

uPress said in a statement posted on its Facebook page that the attack was caused by a WordPress vulnerability, adding it is working with Israel’s National Cyber Security Authority to retrieve the website’s original content. Its customer service for website owners crashed later on Thursday.

The firm said the hackers are Iranian but provided no evidence to support these claims. The Iranian government is unlikely to be involved in the operation, as states rarely conduct such a form of cyberattacks.

Check Point’s Director of Cyber Intelligence, Lotem Finkelstein, told Haaretz the group of hackers comprises of nine people, who have been active since April, and are “probably” linked to Turkey, the Gaza Strip and North Africa. “It doesn’t mean there isn’t more of them, but for now we can’t confirm any Iranian activity,” he said.

Website hosting services are considered a highly desired target for hackers, as they allow access to multiple websites with a single attack. uPress is one of Israel’s biggest website hosting services.

The National Cyber Security Authority warned last week of potential cyberattacks ahead of the Iranian Quds Day, marked on Friday. Rallies to mark the annual day, which uses the Arabic name for Jerusalem, are held across the country and aim to show support for the Palestinians.

This comes just over two weeks after a Fox News report said a cyberattack that targeted Israeli water and sewage systems in April was carried out by Iran. On Monday, the Washington Post reported that Israel was behind a May 9 cyberattack against an Iranian port on the coast of the Strait of Hormuz, and on Tuesday, Israel’s military chief, Lt. Gen. Aviv Kochavi, said that Israel would “continue to act using a variety of military tools and unique methods of combat to strike the enemy.”

Comments