Cyber Attacks Surge as Israel-Hamas Conflict Moves Online
When Hamas launched its October 7 attack on Israeli cities, the assault wasn’t confined to the ground. Within roughly twelve minutes of the opening rocket barrages, Cloudflare’s systems began automatically detecting and mitigating DDoS attacks aimed at Israeli websites that provide civilians with critical rocket alert information. The first wave peaked at 100,000 requests per second (rps) and lasted ten minutes. Forty-five minutes later, a second, far larger attack peaked at 1 million rps, though it lasted only six minutes. Smaller DDoS attempts continued against those alert sites for hours afterward.
The targeting of those civilian alert systems went beyond simple volumetric attacks. According to reporting from Cybernews, the hacktivist group AnonGhost exploited a vulnerability in the "Red Alert: Israel" mobile application, which warns civilians of incoming rockets. The exploit let the group intercept requests, expose servers and APIs, and push fake alerts to some users—including a message claiming a "nuclear bomb is coming." AnonGhost also claimed to have hit other rocket-alert apps.
Cloudflare’s Cloudforce One threat operations team independently identified malicious Android apps impersonating the legitimate RedAlert application. Those trojanized apps were capable of harvesting sensitive device data, including contacts, SMS messages, call logs, installed apps, and phone and SIM details. Cloudflare also flagged an Israeli website that was partially defaced by AnonGhost; that site wasn’t on Cloudflare’s network, but the company reached out to offer assistance.
Israeli Sites Under Sustained Bombardment
The days following the initial attack saw relentless DDoS pressure against Israeli websites. Cloudflare has been helping onboard and protect many of the targeted organizations. Between October 1 and the time of reporting, Cloudflare automatically detected and mitigated over 5 billion HTTP requests tied to DDoS attacks. Prior to October 7, there was virtually no DDoS attack traffic directed at Israeli websites on Cloudflare’s network.
On the day of the Hamas attack itself, nearly 1 in every 100 requests to Israeli sites using Cloudflare was part of a DDoS attack. That proportion quadrupled the next day.
The sector breakdown mirrors patterns seen during the Russia-Ukraine conflict, where media outlets became primary targets. Newspaper and media websites absorbed the largest share of Israeli DDoS attacks at 56% of the total. The computer software industry was the second most targeted sector at almost 34%, followed by banking, financial services, and insurance (BFSI) companies. Government administration sites were fourth.
Palestinian Websites Also Hit Hard
The cyber conflict wasn’t one-sided. From October 1 onward, Cloudflare mitigated over 454 million HTTP DDoS attack requests aimed at Palestinian websites on its network. While that’s roughly a tenth of the volume seen against Israeli sites, it represented a proportionally much larger share of overall Palestinian web traffic.
Before October 7, Cloudflare saw no DDoS attacks against Palestinian websites. That changed immediately: on October 7, over 46% of all traffic to Palestinian sites using Cloudflare was part of DDoS attacks. By October 9, that figure had climbed to nearly 60%—almost 6 out of every 10 requests were attack traffic.
Attack volume against Palestinian sites was heavily concentrated in a few industries. Banking websites absorbed the vast majority—nearly 76%—of all HTTP DDoS attacks. The internet industry was second with a 24% share, while a smaller fraction targeted media production sites.
Defending Against Conflict-Driven Attacks
Real-world conflicts consistently trigger waves of cyberattacks. Cloudflare has published a list of recommendations for optimizing defenses against DDoS attacks, along with step-by-step wizards for securing applications and preventing DDoS attacks. Organizations can also consult Radar dashboards for detailed traffic and attack trend data covering both Israel and Palestine over the past 28 days, as well as Cloudflare’s analysis of broader internet traffic patterns in the region following the October 7 attacks.
All insights are based on traffic and attacks observed against websites using Cloudflare, unless otherwise noted or attributed to a third-party source.
