US Defense Companies in Israel Face Increased Cyberattack Risk from Iran

US defense companies operating in Israel are facing a significantly elevated risk of cyberattacks from Iranian state-sponsored actors and affiliated hacktivist groups. A recent joint advisory issued by top US cybersecurity and intelligence agencies – the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the Department of Defense Cyber Crime Center (DC3) – warns of potential “malicious cyber activity” stemming from the ongoing geopolitical tensions in the region.

The warning specifically highlights Defense Industrial Base (DIB) companies, particularly those with holdings or relationships with Israeli research and defense firms, as being at a heightened risk. While the agencies have not yet observed a coordinated campaign of attacks in the US, they emphasize that Iranian cyber actors are known to exploit poorly secured networks and internet-connected devices for disruptive operations.

This increased vigilance comes amidst a fragile ceasefire between Iran and Israel, following a period of escalated conflict. Historically, Iran has leveraged cyber capabilities as a tool of asymmetric warfare, aiming to inflict economic and psychological blows, collect intelligence, and project power. Recent months have seen a rise in website defacements and leaks of sensitive information exfiltrated by Iranian-aligned hacktivists. Experts anticipate a likely increase in Distributed Denial of Service (DDoS) campaigns against US and Israeli websites due to the recent events.

Iranian cyber tactics frequently involve exploiting unpatched or outdated software with known vulnerabilities, as well as compromising internet-connected accounts and devices that use default or weak passwords. These actors may also employ automated password guessing, password hash cracking, and even legitimate administrative tools for lateral movement and access escalation.

The joint advisory urges critical infrastructure organizations, especially defense contractors, to bolster their cybersecurity postures. Recommended mitigations include disconnecting operational technology (OT) and industrial control systems (ICS) from the public internet, implementing strong, unique passwords, enforcing multi-factor authentication (MFA), and ensuring systems are running the latest software patches. Organizations are also advised to monitor user access logs for remote access to OT networks and establish processes to prevent unauthorized changes.

The ongoing cyber exchanges between Iran and Israel underscore cyberspace as a critical new frontier in international confrontation, demanding constant vigilance and robust defensive measures from all potentially targeted entities.