13 November 2021

Is Iran behind cyberattacks on Israeli hospitals?

Ben Caspit

Israel’s Health Ministry reported Nov. 8 during an urgent Knesset hearing that the Hillel Yaffe Medical Center had still not returned to fully normal operations some four weeks after undergoing a massive cyberattack. “We are in a third world war on cyber,” Reuven Eliyahu, director of information security and cyber at the Health Ministry, told lawmakers at the hearing convened to discuss growing cyberattacks on Israeli health-care institutions. Israel, he added, blocks hundreds of such attacks every month.

The Oct. 13 attack on Hillel Yaffe, a major hospital in the town of Hadera serving the north-central part of the country, was the most sophisticated and damaging of them all, bringing down and locking all the facility’s computer systems, both administrative and medical. The hospital responded with preventive measures, shutting off all its computerized digital systems, ranging from medical imaging equipment to doors and parking garages.

Despite intense repair work, the facility is still not fully back online, with some of the affected data not yet retrieved and some systems still disabled. Experts say the ransom ware attack had all the hallmarks of “state-sponsored” cybercapabilities, although Israel did not point a finger at the obvious culprit, Tehran, not even after a subsequent powerful attack on the Mor Medical Centers run by Israel’s largest HMO, Clalit, that also caused significant damage.

Although it avoided casting blame on Iran, in a rare coincidence, Iran experienced a particularly powerful cyberattack on its gas stations Oct. 26, causing massive and prolonged disruptions at pumps throughout the country. The lines outside the port of Bandar Abbas in May 2020 when a cyberattack shut down its computer systems and paralyzed operations was replaced by endless lines of cars and furious drivers who simply wanted to fill up on gas, but found themselves using the last of their tank reserves as they waited for the pumps to resume working.

“The attack in Iran was undoubtedly carried out by a state power,” a world-renowned Israeli cyberexpert told Al-Monitor, asking that his name be withheld. “The capabilities that were demonstrated in paralyzing a vital national system of gasoline supplies affected ordinary vehicles this time, but next time it could shut down more vital systems, such as military, health care or other important networks.” Asked whether it would be reasonable to assume that the attack was mounted by Israel in a tit for tat for the attack earlier that month on Israeli medical facilities, the source answered, “Hard to say.” He added that there was no proof of Iranian responsibility for the attacks on Hillel Yaffe or the Mor Centers.

Be that as it may, it is hard to know who “fired” the first shot in each of the intensifying cyberbattles between Israel and Iran, and even harder to assess where they could lead and whether such confrontations can even be won. “One thing is certain,” a former senior Israeli security official told Al-Monitor on condition of anonymity, “Cyber is an experimental battlefield enabling the sides to clash with each other without loss of life, at least so far, and to examine each other’s capabilities. In this case, both sides appear familiar with each other’s abilities.”

The disruption of Iran’s gas station network was reminiscent of the 2020 attack attributed by foreign press to Israel on the Bandar Abbas port, which paralyzed Iran’s most important military and civilian port for weeks and caused heavy damage to maritime traffic to and from Iran. “Whereas the previous attacks damaged strategic and vital infrastructure,” a former top cybersecurity official told Al-Monitor on condition of anonymity. “The attack on the filling stations was mainly damaging to Iranian citizens, raising tensions, increasing uncertainty and a sense of insecurity in a country already suffering badly as a result of sanctions and an economy under siege.”

Israel has not assumed responsibility for the attack, nor did it own up to any cyberaggression against Iran (not even to the famous 2010 Stuxnet malware attack attributed by foreign publications to the Mossad and the CIA that heavily damaged Iran’s nuclear centrifuge enrichment project). However, analysis of the most recent known attack points clearly to its aim of increasing chaos in Iran and unrest among the population and its attitude toward the regime.

Without knowing who was behind the attack, it is important to know that Israel’s newly installed Prime Minister Naftali Bennett holds views considered more aggressive than his predecessor Benjamin Netanyahu regarding Israel’s policy on Iran. As a member of the security Cabinet, Bennett talked about the “cat’s paws” or “octopus tentacles” concept presented in the past by former Prime Minister Netanyahu, saying that if Iran was the head of the octopus activating its tentacles, i.e., proxies, or a cat ensconced in Tehran whose paws can touch Israel using proxies, Israel should retaliate against the brain behind the attack, rather than its envoys and mercenaries.

Bennett recently ordered an investment of billions of shekels in a military buildup, including enhancing the capacity of emergency stocks and a speedy upgrade of the military option that Israel devised against the Iranian nuclear infrastructure a decade ago. Bennett, it seems, had no choice but to order these measures once it transpired that the United States was dragging its feet and refusing to present Iran with a powerful, viable military option to destroy its nuclear ambitions should negotiations on an agreement fail.

With the installation of Iran’s radical new Iranian President Ebrahim Raisi in August, the checks and balances of the leaderships in both Tehran and Jerusalem have been weakened. With the stagnating diplomatic negotiations between Iran and world powers, and continued full speed Iranian uranium enrichment while the rest of the world watches, all these elements boil down to one thing — nothing good can come out of the stew in this simmering cauldron.

No comments: