A report by the American newspaper “The New York Times” has revealed that footage captured from cameras mounted on the heads of members affiliated with the Islamic Resistance Movement, Hamas, who were martyred in the “Tempest of Al-Aqsa” operation on October 7th of this year, showed that they had extensive knowledge and secrets about the Israeli army and its weaknesses. The attackers managed to access the server room in one of the Israeli military centers through the information they possessed.
The newspaper suggests that these shots provide “chilling” details about how the Al-Qassam Brigades surprised one of the strongest armies in the Middle East, according to its description.
Experts have offered various theories about how the Palestinian resistance obtained this information, with some even speculating that the movement has spies within the Israeli military.
However, what many have overlooked is that Hamas has a cyber warfare strategy that it began developing over a decade ago, and it continues to evolve rapidly. This was a point emphasized by writer Simon P. Handler in a report he prepared for the Cyber Statecraft Initiative of the Atlantic Council, a member of the Digital Forensic Research Lab, in late 2022.
What is notable in Handler’s report is that he directed his warnings to the United States, not Israel. This underscores the significant danger posed by these cyber capabilities and what they can change in the balance of power on the ground, calling for an understanding of Hamas’s strategy and a different approach in dealing with it.
The cyber space typically offers a crucial opportunity for entities with limited capabilities and resources to compete with their relatively stronger counterparts. Therefore, these entities are increasingly interested in acquiring offensive cyber capabilities and integrating them with their existing tools to advance their strategic goals.
Handler’s report mentions that while the U.S. cyber strategy has primarily focused on its top four main adversaries—China, Russia, North Korea, and Iran—Washington and its allies have failed to predict the electronic and offensive intelligence capabilities of Hamas.
The Green Hat Warriors
Hamas is known for the green headbands worn by its fighters, bearing the word “Tawheed” (Monotheism). Interestingly, this same green color is what distinguishes them in the cyber domain as well.
According to the classification in the cybersecurity community, Hamas is categorized as “Green Hat Warriors,” a classification distinct from others such as Black Hat hackers, White Hat hackers, and Elite hackers.
What sets this green classification apart is that those categorized as Green Hat Warriors are considered “cyber warriors,” not just “hackers” like the other classifications. Despite some leniency in referring to them as Green Hat Hackers for the sake of uniformity, cybersecurity experts differentiate Green Hat Warriors as individuals who continue to develop their capabilities to become stronger, driven by political and ideological motives rather than financial, disruptive, or even criminal objectives.
Security experts suggest that these Green Hat Cyber Warriors are continuously enhancing their capabilities (Medium)
Why Did Hamas Choose the Cyber Space?
Hamas has its own motivations for developing offensive cyber capabilities, and by examining its operations, these motivations become apparent and align with its overarching strategy. These motivations include:
- Propaganda and Recruitment: Hamas’s strong online presence aids in recruitment and gathering information, along with other media-related objectives aimed at drawing attention to the cause they advocate for. These are critical motives for maintaining the movement’s significance and presence among the public.
- Striking in the Shadows: Despite Hamas’s staunch stance against Israel, its leaders are aware of Israel’s military and technological strength. They recognize the areas where the movement can achieve impactful successes while practicing strategic restraint to avoid retaliatory actions that could be devastating. The cyber domain, where activities can be anonymous and attribution is challenging, is one of Hamas’s preferred battlegrounds. They understand that any discovery of their presence could have severe consequences on the ground. Consequently, they abstain from certain cyber operations that other entities working on behalf of nations, such as Russia or China, might undertake. Hamas refrains from targeting Israeli infrastructure with destructive malware, knowing that this could lead to Israeli retaliation. They also avoid deploying ransomware campaigns, which many other organizations employ for financial gain, disruption, or even political motives.
- Cost-Effectiveness: The Atlantic Council report warns against underestimating Hamas’s cyber capabilities. While they may be relatively weak and lack sophisticated tools possessed by other hackers, Hamas has surprised many with its capabilities. This is despite Israel’s control over communication frequencies and infrastructure, as well as the persistent electricity shortages in Gaza. Tel Aviv regards Hamas’s offensive cyber threat as highly dangerous, and in 2019, it thwarted one of the group’s electronic operations. The Israeli Defense Forces launched an airstrike targeting what it claimed to be “Hamas’s cyber headquarters,” targeting a building in Gaza. It was one of the first acknowledged operations by the military in response to an electronic attack. However, despite the Israeli military’s claims that “Hamas no longer possesses electronic capabilities after our strike,” numerous reports have shed light on electronic operations conducted by the movement in the following months and years.
In conclusion, Hamas’s cyber capabilities represent a formidable and evolving threat. Its strategy encompasses intelligence gathering and the dissemination of misleading information to achieve military and counter-propaganda objectives. This strategy not only shields the movement from Israeli retaliation but also allows it a margin of maneuvering necessary for its long-term military plans. This was evident in the recent major operation, the “Tempest of Al-Aqsa.”
Note: This article is a rewrite of the provided information in English and does not represent any endorsement or confirmation of the claims made in the original Arabic text.
