Sweet, sweet trap: How Israel is using 'vulnerable targets' to honeypot cyber Hamas, Syrian hackers

In light of Israel-Hamas war, experts in cybersecurity noted a substantial increase in the number of internet-connected honeypots in Israel. These honeypots, fabricated networks designed to attract hackers, have become a crucial component in the ongoing conflict’s digital landscape.

Honeypots, commonly employed by cybersecurity firms and governments, serve as bait to identify and observe hackers’ activities on controlled decoy networks. Despite the tangible, physical clashes between Israel and Hamas, the year 2023 reveals a digital facet to every conflict, with the deployment of honeypots aiding in understanding hackers’ strategies amid the ongoing crisis.

John Matherly, the founder of Shodan, a search engine for exposed devices and networks, reported a surge in the number of honeypots in Israel, with these imitating a diverse array of products and services. The goal is not to mimic specific devices but to detect any malicious activity across the country.

Matherly indicated that the rise began in September and has continued to escalate, with most honeypots focused on running web servers. Notably, there’s a concentration on monitoring broad-scale attacks rather than specifically targeting industrial infrastructure assaults.

Piotr Kijewski, CEO of the Shadowserver Foundation, confirmed a significant uptick in deployed honeypots in Israel post-October 7, propelling the country into the top three globally for the number of deployed honeypots. Before the conflict, Israel wasn’t even in the top 20.

According to a report, the exact entity behind this surge in honeypot deployment remains unclear. However, strategically, deploying honeypots could provide Israel with a tactical advantage, enabling them to monitor online activities of adversaries.

Silas Cutler, a resident hacker at cybersecurity firm Stairwell, affirmed the tactical sense in deploying honeypots during a conflict, citing a similar approach during the early months of the war in Ukraine. Cutler explained that deploying infrastructure for observation becomes crucial in gaining insights into the heightened background noise of internet exploitation during such turbulent times.

Despite these developments, the party responsible for deploying the honeypots across Israel and the specific motivations behind it remain undisclosed. Requests for comments from the Israel Defense Forces have not received a response as of yet.