Check Point Warns of Cyberattack Surge and Phishing Ahead of Israel Vote
Check Point researchers report a 55% surge in cyberattacks against Israeli organizations ahead of elections, with malicious domains and dark web threats targeting critical infrastructure and government portals.
More than 1,200 new websites related to the elections in Israel were registered in September and October, with one out of every 47 suspected of being malicious, according to data from Check Point Software Technologies researchers. Experts are warning against attempts to exploit the election period for cyberattacks, including a phishing campaign masquerading as a voter information system.
The findings are based on tracking conducted by company researchers in recent weeks regarding cyber threats and influence operations ahead of the Israeli elections. The research combines attack data with monitoring of threat actor groups across various forums, Telegram channels, and the dark web.
According to the data, there has been an increase in the volume of cyberattacks against Israel and the government sector. The average number of weekly cyberattacks per organization in Israel rose by 55% compared to the same period last year, reaching approximately 2,700 attacks. In the government sector, attacks surged by 82%, averaging about 2,300 per week.
The most significant increase was recorded in the energy and infrastructure sector, which saw a 107% jump compared to last year, averaging approximately 3,900 attacks per week. Meanwhile, the pace of reports regarding leaks and successful cyberattacks has also grown, with 87 cyberattacks verified against Israel since the beginning of October, mostly aimed at website defacement or distributed denial-of-service operations.
Threat Actor Activity and Dark Web Preparedness
Over the past ten days, public activity by anti-Israeli, Iranian, and other threat groups has intensified. These groups published materials they claimed to have obtained through cyberattacks, including videos, photos, and files related to Israeli public figures, IDF military bases, correspondence of public representatives, and personal data databases.
Among these groups is the Iranian hacker collective "Handala", which significantly increased its publication rate and tied it directly to the Israeli elections. Discourse analysis attributes 53% of the incidents to pro-Palestinian activists, 18% to Indonesian activists, and 10% to criminal entities.
Furthermore, dark web discussions regarding the Israeli elections surged by 110% in October compared to September. Attack groups are reportedly preparing for election day by planning disruption operations against major websites, including the Prime Minister's Office, the Knesset, the Israel Police, the Ministry of Foreign Affairs, and the Bank of Israel. Additionally, a database containing 6.5 million Israeli voter records has resurfaced for sale on the dark web.
Sivan Dror, Research Director of Exposure Management at Check Point, noted:
"The days surrounding the elections are a critical window where threat actors can exploit public attention to amplify their impact. Organizations must ensure that official websites and accounts are secured and prepared for rapid incident response."
Recommendations for Organizations and the Public
Check Point recommends that the public verify any information regarding polling station locations, voting hours, or eligibility exclusively through official channels. Citizens are advised to avoid disclosing passwords, verification codes, or payment details in response to suspicious messages.
For organizations, experts recommend ensuring that website defense mechanisms are active, enforcing multi-factor authentication for administrative accounts and social networks, and establishing dedicated incident response teams with alternative communication channels.
