How Israel uses ‘soft targets’ to lure Hamas and Syrian hackers

In light of the war between Israel and Hamas, cybersecurity experts have noted a substantial increase in the number of internet-connected honeypots in Israel. These honeypots, fabricated networks intended to attract hackers, have become a crucial part of the digital landscape of the ongoing conflict.

Honeypots, commonly used by cybersecurity companies and governments, serve as bait to identify and observe hacker activities on controlled decoy networks. Despite the physical and tangible clashes between Israel and Hamas, the year 2023 reveals a digital side of each conflict, with the deployment of honeypots helping to understand the strategies of hackers in the context of the current crisis.

John Matherly, the founder of Shodan, a search engine for exposed devices and networks, reported an increase in the number of honeypots in Israel, which imitate a diverse range of products and services. The goal is not to imitate specific devices but to detect any malicious activity across the country.

Matherly said the surge began in September and continued to intensify, with most honeypots focused on running web servers. Particular emphasis is placed on monitoring large-scale attacks rather than specifically targeting attacks against industrial infrastructure.

Piotr Kijewski, CEO of the Shadowserver Foundation, confirmed a significant increase in the number of honeypots deployed in Israel after October 7, propelling the country into the top three in the world for the number of honeypots deployed. Before the conflict, Israel was not even in the top 20.

According to a report, the exact entity behind this increase in honeypot deployment remains unclear. However, strategically, the deployment of honeypots could provide Israel with a tactical advantage, allowing it to monitor the online activities of its adversaries.

Silas Cutler, resident hacker at cybersecurity firm Stairwell, affirmed the tactical sense of deploying honeypots during conflict, citing a similar approach during the early months of the war in Ukraine. Cutler explained that deploying observational infrastructure becomes crucial to better understand the increased background noise of operating the Internet during these turbulent times.

Despite these developments, the party responsible for deploying the honeypots across Israel and the specific motivations behind it remain confidential. Requests for comment from the Israel Defense Forces have not yet been responded to.