Iran shifted focus of cyberattacks from US to Israel, Microsoft says

Microsoft signage is seen at the company's headquarters in Redmond, Washington, US, January 18, 2023.
Microsoft signage is seen at the company's headquarters in Redmond, Washington, US, January 18, 2023.

Iran trained most of its cyber might away from the United States toward Israel since the Gaza war began last year, according to a report by technology giant Microsoft.

"Iranian nation-state actors used ransomware in a cyber-enabled influence operation, marketing stolen Israeli dating website data," Microsoft said.

Following October 7, when Iran-backed Hamas led an attack on Israel, the report cites a marked increase in cyber operations aimed at Israel. From October 7, 2023 to July 2024, "nearly half of the Islamic Republic's cyber operations… targeted Israeli companies", it said.

Microsoft: "Example of Iran’s targeting shift following the start of the Israel-Hamas conflict."
Microsoft: "Example of Iran’s targeting shift following the start of the Israel-Hamas conflict."

Iran's cyber efforts are not confined to Israel. The report adds that Iranian and Russian actors are leveraging the ongoing conflicts to spread "divisive and misleading messages through propaganda campaigns" beyond the immediate geographical boundaries of the conflicts.

Microsoft emphasized the continued targeting of the US and Persian Gulf nations, particularly the UAE and Bahrain due to their normalization of ties with Israel.

Cyber defense chief Gaby Portnoy warned in June that since the outbreak of the Gaza war on October 7, cyberattacks by Iran have become more aggressive, targeting not only Israel but also its allies.

“We have identified that Iran is attacking its allies and other countries for information extortion and damaging digital services,” said Portnoy, head of the Israel National Cyber Directorate (INCD), at the Cyberweek annual conference held at Tel Aviv University.

Portnoy warned that the information stolen from government systems is then used for Iranian cyberterrorism, making Iranian cyber aggression "an international problem, not only an Israeli one, and therefore the solution needs to be international".

Also in August, Microsoft released its Threat Intelligence Report, which provided a comprehensive analysis of how various groups orchestrated influence campaigns aimed at swaying voters, particularly in swing states.

These operations were complemented by intelligence-gathering activities on political campaigns, potentially establishing a foundation for future interference, it said.