OpIsrael: Looking ahead to April 7 with ABI

Steve Townsley | 15 March 2016

At any one time, there is a host of hacktivist operations announced, discussed and in action. Some of these are conducted by credible actors that carry a substantial threat, whereas others are not. With the amount of noise and rhetoric out there online, and especially social media, it is often hard to find meaning in this. So how can we, as information security professionals, understand these threats, and support our decision making?

Take this example from the long standing anti-Israel hacktivist operation OpIsrael:

OpIsrael Announcement 

 

Following the YouTube link plays a video that explains the motivations for the operation, as well as links to further announcements, Facebook groups, and DDoS tools. It reveals that the operation will  take place on 07 Apr 2016, and will target organizations associated with Israel. The choice of date is likely due to 07 Apr being the date of the Holocaust Memorial Day in 2013 (the year the operation started.

Well, that does actually sound quite concerning, and what if your organization has a presence in Israel? How can you go about understanding this?

We have been following OpIsrael since 2013, and the benefit of it happening on the same date every year is that we can compare activity to that of previous years. Check out the below graph which shows usage of “OpIsrael” on Twitter since 2013. This demonstrates that the operation was discussed a lot on April 7th 2013, less so April 7th 2014, and then increasing again in April 2015. The increase in activity during July/August 2014 can be attributed to the 2014 Israel-Gaza conflict.

 OpIsrael 3year Timeline

The operation happens consistently every year on April 7th, and activity will increase in relation to activity on the ground in the region.

You’re probably thinking “Ok, so that’s great, but it’s March 2016 right now. How can I make an assessment for what will happen this April 7th?!?!” Well I’m glad you asked. Because for this, we can use Activity Based Intelligence.

Let’s look at the activity related to OpIsrael during Q1 since 2013. Comparing this to the activity seen so far during 2016:

 OpIsrael 3month Timeline

Activity during 2016 thus far looks very similar to the same period last year. Another way to visualize this activity is to view that volume of mentions compared by year.

OpIsrael Year by year 

In short, activity up until 04 February 2016 suggests that the operation may be as active as it was during 2015.

Let’s take that assessment (whilst recognizing that a lot can happen between now and 7th April 2016) and take it as certain. What does this mean? A lot can be learned from last year’s OpIsrael, and my next blog will tackle this in more detail.