Threat Profile: CyberAvengers

Over the weekend, the reputable Israeli oil refinery BAZAN Group suffered an extensive distributed denial-of-service (DDoS) attack from a rather quiet threat organization who call themselves CyberAvengers (a.k.a CyberAv3ngers). These actors originally formed the group back in 2020 but have stayed under the radar over the past few years.  The group appears to be primarily focused on exploiting critical infrastructure organizations throughout Israel, specifically electrical grids and service providers. One (1) such claimed attack from the CyberAvengers occurred against the Israeli power grid, where attackers destabilized power supply to key cities throughout the region including Herzliya, Tel Aviv, Netanya, Bat Yam, and others. These attacks were believed to be attributed to CyberAvengers after their social media accounts shared videos claiming responsibility for causing over 7,500 outages throughout these cities. CyberAvengers actors also had been suspected of compromising critical water assets in the region shortly after the power grid attacks, but no evidence pointed to the group aside from a unique timeline. Since these attacks, the group has remained passive until their recent DDoS attack on BAZAN Group. Researchers are unsure if the group will continue its attacks for the weeks to come or if they will take another hiatus. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.