The news about the Israel-Hamas war is filled with reports of Israeli families huddling in fear from relentless rocket attacks, Israeli tanks and artillery flattening buildings in the Gaza Strip, hundreds of kidnapped hostages imprisoned in subterranean tunnels, and millions of people driven from their homes by fighting.

But beyond the visceral violence lies a hidden layer of the war – an online conflict. We are scholars of cyberwarfare who have cataloged and analyzed the various cyber operations conducted during the war by Hamas, Israel and other nations and hacking groups supporting one side or the other. The data paints a picture of an unseen facet of the conflict, and it offers insights about the nature of cyber conflict more broadly.

The main conclusion we’ve drawn is that the consequences of cyber conflict are primarily felt by civilians, not the soldiers or militants actively engaged in the fighting. We find that the damage cyberattacks inflict on digital systems is far less significant than the resulting harm to humans, and the resulting upward spiral of violence.

The cyberattacks hitting Israeli government and civilian systems have had mixed effects. Some technically simple attacks succeeded in obtaining crucial intelligence that assisted Hamas fighters’ incursion into Israel. Other attacks employed a scattershot approach, targeting anything within digital reach – hospitals, universities, banks and newspapers. These attacks didn’t serve any military purpose, but simply aimed to disrupt Israeli life and terrorize the public.

The quantity and sophistication of the attacks have made clear that hackers working for the government of Iran, a key Hamas funder and supplier, are supporting Hamas’ online warfare. Other “hacktivists” and private hacking groups based in countries as varied as Sudan, Pakistan and Russia have also joined the fray.

Before the deadly Oct. 7, 2023 terror attack on Israel that sparked the current war, Hamas cyber operatives were working to support the attack planning. A Hamas hacking unit called Gaza Cybergang spied on Israel in search of sensitive information about Israeli military installations. The information they gleaned was instrumental during the attack.

Hamas hackers also conducted phishing attacks, relatively simple attacks in which fake email or text messages resemble legitimate ones and encourage a user to either reply with sensitive information or click on a link that downloads malicious software to their computer or mobile phone.

As the Oct. 7 attack unfolded, the pro-Palestinian hacktivist group AnonGhost released a mobile app with the same name as a prominent reputable app that gives Israeli citizens warnings about impending attacks from Hamas into Israel. AnonGhost issued false alerts – including, reportedly, one about a nuclear attack – and collected users’ data, including their contacts, call logs and text messages.

However, since full-fledged hostilities erupted, Hamas has been largely unable to carry out effective cyberattacks that aid its war efforts. As a result, the group turned to information warfare, seeking to evoke panic and shift public opinion.

The most common type of attack that Hamas’ cyberwarriors and their allies use now is a distributed denial-of-service, when a barrage of nonsense internet traffic is aimed at one or more websites, email servers or other internet-connected systems. They get overwhelmed by the nonsense traffic and either shut down or cease to function properly.

...continued