Israel ranks 1st among countries targeted by geopolitical cyberattacks in 2025 — report

Israel was the most attacked country in the world by geopolitically motivated hackers and malicious actors in 2025, as the country’s multifront wars with the Hamas terror group and Iran and its proxies spurred a spike in cyberattacks, according to the annual global cyber threat analysis report published Thursday by Israeli cybersecurity firm Radware.

With 12.2 percent of all global geopolitically motivated cyberattacks directed at the country over the past year, Israel is at the top of the 2025 list, followed by the United States with 9.4%, and Ukraine with 8.9%, according to Radware’s report. This means that almost one in eight ideologically motivated attacks in the world was directed against Israel, as state and national conflicts are increasingly shifting into the digital arena.

Radware noted that the “distribution underscores the role of hacktivism as a proxy weapon in international conflicts, used to disrupt the digital infrastructure of perceived state adversaries.”

The two-year Hamas war in Gaza and the 12-day military conflict with Iran in June last year have fueled hacktivist activities, leading to an increase in politically motivated cyberattacks targeting public, private, and critical infrastructure. In 2025, Israel was the target of 1,881 unique attack claims, up from 1,550 a year earlier, according to Radware data.

Earlier this year, cyber defense chief Yossi Karadi warned that Israel needs to bolster its preparedness for what he described as a fast-approaching “cyber war.” Meanwhile, the Shin Bet security agency and National Cyber Directorate said that in recent months, hundreds of Iranian cyberattacks targeting Israelis — including senior government and defense officials, academics, and journalists — were detected and foiled. In 2025, the National Cyber Directorate said it saw an increase of 55% in the number of cyberattacks year-on-year.

Radware analysis found that across all targeted countries, government services were the primary focus for hacktivists, accounting for 38.8% of all claimed attacks as bad actors sought to disrupt state functions and undermine public confidence.

The availability of generative AI tools enables attackers with relatively limited resources to launch large-scale automated campaigns, including account takeover attempts, data scraping, and repeated login attacks. As a result, many cyberattacks are extremely short, sometimes lasting less than a minute, making manual detection increasingly difficult, according to the report.

“The threat landscape is evolving rapidly,” said Radware VP of threat intelligence Ron Meyran. “Attackers are now combining automation, artificial intelligence, and multi-vector strategies to disrupt operations at scale.”

“Organizations must adopt automated defenses capable of responding in seconds, not minutes,” Meyran cautioned.

Among the top three hacktivist groups targeting Israel in 2025 were the pro-Iran group Arabian Ghosts, followed by Black Ember, pro-Palestinian Mr Hamza, and pro-Russian group NoName057(16). Across all countries, NoName057(16) was the top hacktivist actor in terms of the number of attacks in 2025.

Globally, cyberattacks using a so-called Distributed Denial of Service (DDoS) model – where hackers flood websites with traffic to slow or halt operations on systems – soared by 168% last year compared to 2024, according to the report.

“The data confirms that hacktivists prioritize countries with ongoing geopolitical conflicts, using DDoS attacks as a tool for political protest and nationalist signaling,” said Radware. “Ideologically driven threat actors are running ongoing DDoS campaigns against government websites, critical infrastructure, and commercial companies, sometimes publicly claiming responsibility for attacks in real time through dedicated Telegram channels.”

In 2025, malicious activity targeting websites and digital services rose by more than 120% compared to the previous year. Radware noted that the application layer has become the primary battleground, as it allows attackers to directly disrupt business systems, customer operations, and core organizational processes.

Radware said it expects 2025 trends to “continue in the coming years, with application-focused attacks, automated activity, and the use of cyberspace as a tool in geopolitical conflicts becoming a permanent part of the operating environment for organizations.”