The Head of the Israel National Cyber Directorate (INCD), Brig. Gen. (res.) Yossi Karadi, revealed in his first public address at the Cyber Week conference at Tel Aviv University the attack and influence methods Iran has deployed against Israel over the past six months, including during Operation “Rising Lion.”
Among the examples he presented was the cyberattack that was thwarted at Shamir Medical Center on Yom Kippur. In that incident, the ransomware group Qilin served as a cover, behind which an Iranian state-sponsored threat actor attempted to hide in order to mask its tracks and leverage the criminal group’s tools and capabilities. According to Karadi, the incident demonstrates how blurred the line has become between criminal activity and hostile state operations.
Karadi introduced the concept of the “First Cyber-Based War”—a war that will be conducted without a single shot being fired, in which a state could be attacked exclusively through cyberspace, potentially paralyzing critical systems and creating what he called a “digital siege.”
“We are heading toward an era where a war will begin and end in the digital domain, without a single tank moving or a single aircraft taking off,” he said. “Picture a digital siege: power stations shut down, communications severed, transportation paralyzed, and water supplies contaminated. This is not a fictional scenario — it is a very real trajectory.”
He added, “In this war, every digital infrastructure becomes a frontline, and every citizen becomes a target. We are rapidly approaching a stage where cyber will fully replace the physical battlefield.”
According to the data presented, during Operation “Rising Lion” the INCD identified 1,200 influence campaigns targeting Israeli civilians. This means that over a two-week period, millions of citizens received or were exposed at least once to deceptive messages or influence videos. Additional trends observed during the operation included coordinated physical–cyber attacks; large-scale influence operations designed to mislead the public during emergency moments; targeted information gathering on Israeli military, governmental, and academic figures for the purpose of physical intimidation; and a shift by Iranian threat groups from pure espionage and intelligence collection to disruptive and destructive cyberattacks.
Karadi also described the missile strike on the Weizmann Institute of Science, which was accompanied by cyber and psychological operations: Iranian actors infiltrated the security cameras to document the impact and sent threatening emails to faculty members. The case illustrates the merging of physical damage with cyber-enabled influence.
In his address, the INCD head noted that Israel ranks as the third most attacked country in the world, according to Microsoft’s latest data, with 3.5% of all global cyberattacks directed at Israel over the past year. “These are figures associated with global powers, and Israel finds itself on a continuous global frontline,” Karadi said, emphasizing that the threats are not isolated events but an ongoing reality that demands constant defense. He stressed that Israel’s real-time experience provides a significant strategic advantage and positions the country at the forefront of global thinking on the future of cyber warfare.
According to Karadi, “Our total dependence on digital systems — combined with the explosion of artificial intelligence across every domain of life — brings extraordinary opportunities but also new threats, giving cyber adversaries an almost unlimited arena.”