In a panel held today (Tuesday) at the Cybertech Global 2024 conference at Expo Tel Aviv, the head of the national cyber system Gabi Portnoy revealed that the intensity of cyber attacks has increased since the beginning of the war - three times than before. Portnoy also revealed at the conference the members of the hacker group "Black Shadow" which operates under the cover of a private company in Tehran but actually works for the Iranian Ministry of Intelligence.
Portnoy described at the conference the cyber space during the war and said that at the same time as the war effort in the various arenas, "in the cyber arena according to the order of the Iranian leader Khamenei, all the cyber attack groups operating on behalf of Iran and Hezbollah began to attack Israel around the clock." Moreover, Portnoy noted that "the cooperation between Iran and Hezbollah increased during the war, as we saw in the coordinated attack against Ziv Hospital in Safed."
At the conference Portnoy revealed the Iranian attack group operating on behalf of the Iranian Ministry of Intelligence and known mainly under the nickname "Black Shadow". Portnoy revealed that the group operates under the guise of the Jahat Perdaz company, established in 2013, which allegedly deals in the field of IT and software and works from an office building in the heart of Tehran. The Black Shadow attack group, whose name has previously been published several times in the Israeli media as being responsible for a series of cyber attacks against Israeli companies, is also known by the names "Agrius" and "Malek Team".
According to Portnoy, recently, against the background of the war, the group tried to attack a wide variety of sectors in Israel, including organizations in the fields of academia, tourism, media, finance, transportation, health, government and technology. The scope of the group's activity increased during the "Iron Swords" war, at the same time as other attack groups from Iran and around the world. Despite the efforts to cause damage to the economy, recently the group's ability to produce significant damage to the economy has been damaged.
The Black Shadow attack group is well known to the cyber defense community and was recently exposed in the Iranian media on the "Iran International" website, including its location and the names and photos of the company's employees. In doing so, it lost the dimension of secrecy in its activity, which is a cornerstone of offensive cyber activity.
Portnoy also said at the conference: "I'm worried about what might be hiding behind the invisible veil that we don't see yet, and which might contain the next cyber surprise. I ask myself every day, what will be the October 7th of the cyber world." According to Portnoy, "Foreign influence campaigns on social networks that are empowered by artificial intelligence carry risk-related damage scenarios and may affect people's trust in the digital world. In the digital age, the loss of trust in digital services and information can cause damage to functional continuity and governance."
At the same time, the CEO of Check Point, Gil Shvid, revealed that the world is in the age of the most sophisticated cyber attacks known to mankind. "We are in the age of the most sophisticated cyber attacks we have seen, of all types. We see ideological, criminological attacks - which are the most common, state-sponsored attacks and more. We see our enemies getting stronger."
Schweid noted that in recent months there has been a doubling in the number of attacks on Israel. "Attacks from Iran and Hezbollah have become routine," he said. "These attacks a few years ago were not of such intensity, the sophistication is much more significant and this is also thanks to the fact that the Internet is accessible to everyone, both to countries and to terrorist organizations around the world."
According to Shvid, we are currently in the fifth generation of cyber attacks, characterized by sophisticated detection, rapid network distribution, takeover of networks and enormous potential damage, which includes information theft. "Artificial intelligence serves us all, and helps both the attackers and the attacked," Schweid said. "In the past, the attackers seemed unsophisticated, today it is very easy with the help of AI. Even with phishing emails, there is no comparison compared to the past. It used to look very suspicious, today they ask for what - AI and it is very simple. But this is also expressed in the construction of codes, and in the attack Sophisticated. It also helps the cyber companies a lot with the help of AI technology, every month there is a new AI mechanism that knows how to detect cyber attacks and protect."