A previously unknown cybercrime group attacked an Israeli technical university over the weekend, demanding $1.7 million in bitcoin as payment for what the attackers claim are the Israeli government’s “lies and crimes” ranging from occupation to war crimes to tech layoffs.
The Israel Institute of Technology, also called Technion, announced the attack on Twitter midday Sunday, and on Monday tweeted that the school remained “under a challenging cyber attack,” calling it a “complex event,” according to a Google translation. Around the same time, the online malware repository vx-underground posted a photo purporting to show the ransom note in which the group identified itself as “DarkBit” and demanded 80 Bitcoin.
The school said Monday services were slowly returning to normal, but its website remained inaccessible Monday morning U.S. time. The school said in one of its tweets that it had “proactively blocked all communication networks.”
DarkBit launched a Telegram channel on Saturday and claimed responsibility for the attack on the school, calling it “the technological core of an apartheid regime,” and threatening more attacks on entities affiliated with Israel.
It’s not yet clear who is behind the group. The name could be seen as an amalgamation of older, established ransomware variants DarkSide and LockBit, and the demand of 80 Bitcoin follows an established ransomware pattern. But the ransom note seems designed to evoke the appearance of hacktivism, with the references to war crimes and occupation.
