{ "id": "ba67d39a-6f3d-474a-8ccb-7ee41bff8968", "created_at": "2026-04-06T00:10:11.463387Z", "updated_at": "2026-04-10T03:26:36.628718Z", "deleted_at": null, "sha1_hash": "93a3039ddc8e9542ea72eee16cced19d4e3b57ea", "title": "Hacktivist Groups Use Defacements in the Israel Hamas Conflict", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 449543, "plain_text": "Hacktivist Groups Use Defacements in the Israel Hamas Conflict\r\nBy DarkOwl Content Team\r\nPublished: 2023-10-26 · Archived: 2026-04-02 12:37:08 UTC\r\nOctober 26, 2023\r\nDisclaimer: DarkOwl is not affiliated with any of the groups mentioned in this article and do not support the actions of\r\ncybercriminals regardless of their motivations. This information is provided for informational purposes only and has not been\r\nindependently verified.\r\nIntroduction \r\nDefacement attacks, involve the unauthorized modification or vandalism of a website or web application. These\r\nattacks typically result in the alteration of the website’s content, appearance, or functionality by attackers with\r\nmalicious intent. The primary goals of defacement attacks are usually to deface the targeted website, display a\r\nmessage or image, and often to spread a message or agenda, drawing attention to the attacker’s cause or skills. \r\nIt’s important to note that defacement attacks are just one form of cyberattacks, and they usually don’t involve\r\ndata theft or damage to the website’s infrastructure. However, they can still have a significant impact on the\r\nwebsite’s reputation and the trust of its visitors as well as voicing political messages. \r\nAs the events in Israel and Gaza have unfolded, defacements have been a common technique used by cyber actors\r\nto target opponents. Here we examine some of the groups conducting these attacks and the victims.  \r\nDragonForce Malaysia \r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 1 of 6\n\nDragonForce Malaysia is a pro-Palestinian group located in Malaysia. The group are active on social media with\r\naccounts on Telegram, Twitter and Instagram. They also have their own website and forum where they detail their\r\nactivities.  \r\nHistorically the group have primarily conducted distributed denial-of-service (DDOS) and defacement attacks,\r\nand this pattern is being replicated in response to the October 07 attack on Israel. However, they have also been\r\nseen to use other exploits.\r\nSince the beginning of the conflict, DragonForce have mounted defacement attacks against approximately 125\r\nwebsites with .il domains. There does not seem to be a pattern to the websites that are targeted other than their\r\naffiliation to Israel, although multiple Op names have been used on their various defacement messages. As shown\r\nbelow they have also used their defacements to encourage other hackers to join their cause.  \r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 2 of 6\n\nTheir Telegram channel has also been used to highlight other attacks that they have conducted, including a claim\r\nto have accessed the “Israel Telephone system Management,” as well as other Israeli Telcos. Samples of the data\r\nhave been posted on their telegram channel. They are also sharing leaked databases as seen in the image below.\r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 3 of 6\n\nCyb3r_Drag0nz_Team \r\nSimilarly, to DragonForce Malaysia the Cyb3r_Drag0nz_Team is a pro-Palestinian group which has been active\r\ncreating defacements since the beginning of October. However, they appear to have cast a wider net in terms of\r\nwho they are targeting with a number of US victims in the education space as well as in other countries, including\r\nIsrael.  \r\nAs well as providing details of the group in their defacement message they also supply the usernames/Aliases of\r\nindividuals who have assisted in the attack as shown below. They also provide details of their Telegram and\r\nTwitter accounts. \r\nThis highlights the fact that groups which conduct defacement attacks are usually looking for notoriety and often\r\nare active on social media in order to publicize their actions. This group have conducted defacement attacks\r\nagainst approximately 157 websites since October 08, 2023, as of the writing of this article.  \r\nThe Telegram account of this group has been used to promote the defacements it has conducted; this appears to be\r\nthe main activity that they conduct although they have also released leaked information purporting to contain\r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 4 of 6\n\nIsraeli citizen data. This underscores that with this conflict normal citizens are being targeted as well as\r\ngovernments and military organizations.  \r\nX7root \r\nThis group has also conducted defacement attacks against Israeli websites, including kdh.org.il which is the\r\nJewish Burial society, this appears to still be active. This defacement message also includes an image from the\r\nHolocaust likely to cause the most amount of offense possible. The image is not included here but the\r\naccompanying message is shown below.  \r\nLittle is available about this group, but they do also have a Telegram channel which has previously been used to\r\nsell exploits and requires a $90 subscription fee. However, recent posts on the channel have been anti-Israel in\r\nnature and provide details of the websites which have been defaced. In posts made on Telegram the user states that\r\nhe is Arab and shows support for individuals in Gaza. The user is using the #OpIsrael which has been used by\r\nmany pro-Palestinian groups.  \r\nConclusion \r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 5 of 6\n\nDefacement attacks are not a new technique, but they can become particularly effective in times of conflict, as\r\nthey were in Russia and Ukraine, in order to share the attacker’s message. The majority of defacement attacks that\r\nwe have observed have been conducted by Pro-Palestinian groups, but Pro-Israel groups are also conducting\r\ncyberattacks.  Defacements are a powerful tool for hacktivist groups seeking to use their skills to share a message. \r\nDefacements are in some ways unique in that they seek to publicize the actors behind them, their views and their\r\nactivity. Therefore, they are more prominent and easier to detect than some other attacks and usually less\r\ndestructive as they do not tend to affect the underlying infrastructure. As hacktivists seek to take a stand, they\r\ndiffer from the more traditional cyber espionage which seeks to stay in the shadows, but it is very likely those\r\nattacks will escalate in the coming months.  \r\nStay up to date with the latest research from the DarkOwl analyst team and subscribe to our\r\nemail newsletter.\r\nSource: https://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nhttps://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "MISPGALAXY" ], "references": [ "https://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/" ], "report_names": [ "hacktivist-groups-use-defacements-in-the-israel-hamas-conflict" ], "threat_actors": [ { "id": "6608b798-f92b-42af-a93f-d72800eeb3a3", "created_at": "2023-11-30T02:00:07.292Z", "updated_at": "2026-04-10T02:00:03.482199Z", "deleted_at": null, "main_name": "DragonForce", "aliases": [], "source_name": "MISPGALAXY:DragonForce", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "843f4240-33a7-4de4-8dcf-4ff9f9a8c758", "created_at": "2025-07-24T02:05:00.538379Z", "updated_at": "2026-04-10T02:00:03.657424Z", "deleted_at": null, "main_name": "GOLD FLAME", "aliases": [ "DragonForce" ], "source_name": "Secureworks:GOLD FLAME", "tools": [ "ADFind", "AnyDesk", "Cobalt Strike", "FileSeek", "Mimikatz", "SoftPerfect Network Scanner", "SystemBC", "socks.exe" ], "source_id": "Secureworks", "reports": null } ], "ts_created_at": 1775434211, "ts_updated_at": 1775791596, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/93a3039ddc8e9542ea72eee16cced19d4e3b57ea.pdf", "text": "https://archive.orkl.eu/93a3039ddc8e9542ea72eee16cced19d4e3b57ea.txt", "img": "https://archive.orkl.eu/93a3039ddc8e9542ea72eee16cced19d4e3b57ea.jpg" } }