Researchers have discovered threat actors targeting rocket alerting applications and creating malicious versions to target Israeli Android users. As of October 13, 2023, over 5,000 rockets have been launched into Israel following the Hamas attacks that began on October 7, 2023. The app “RedAlert – Rocket Alerts” was developed by Elad Nava to allow individuals to receive “timely and precise alerts about incoming airstrikes” and has been downloaded over 1 million times. A malicious Google Android Application (APK) of the “RedAlert – Rocket Alerts” application has been identified on a malicious website (created on October 12, 2023) impersonating the legitimate site. Researchers noted that an iOS application is also shown on the website but refers users to the legitimate iOS application. The fraudulent Android application acts as spyware and requests permissions to access contacts, account information, call logs, SMS, and an overview of installed apps. The following information is currently collected by the APK: device details (SIM data, network type, country, PIN status, voicemail number, etc.), full contact list, list of accounts associated with the device, logged-in email and app accounts, list of installed apps, and all phone calls and conversation details for incoming, outgoing, missed, rejected, and blocked calls. The exfiltrated data is sent to a hardcoded IP address and researchers did not attribute the fraudulent application to a specific threat group at this time. The malicious application also includes anti-analysis capabilities that begin once the app is started by the victim. Researchers have also been observing multiple threat groups choosing sides in the conflict. The Pro-Palestinian hacktivist group AnonGhost has been observed targeting Israeli users since the Hamas attacks began by allegedly exploited a vulnerability in the application “Red Alert: Israel” by Kobi Snir. This has allegedly allowed them to “intercept requests, expose servers and APIs, and send fake alerts to some app users, including a message that a ‘nuclear bomb is coming’.” AnonGhost has also claimed to have attacked additional applications, including “RedAlert” by Elad Nava. CTIX analysts are continuously monitoring this ongoing conflict and will provide updates relating to cyber movement when applicable.