The Most Attacked Country: Israel's Cyber Threat Landscape in 2025-180
June 12, 2026
A country of fewer than ten million people absorbed nearly one in eight ideologically motivated cyberattacks in the world last year. That figure — 12.2 percent of all geopolitically driven attacks globally, according to Radware's 2026 threat analysis — is not a statistical anomaly. It is the digital signature of a country simultaneously at war on multiple fronts, whose conflicts have made it the focal point of a globally distributed hacktivist ecosystem that operates in real time, claims attacks on Telegram, and has no intention of stopping when the shooting pauses.
Israel received 12.2 percent of all geopolitically motivated cyberattacks globally in 2025 — making it the most targeted country in the world by that measure, ahead of the United States at 9.4 percent and Ukraine at 8.9 percent. Nearly one in eight ideologically motivated attacks worldwide was directed at a country with fewer than ten million people, a concentration that reflects the degree to which Israel's simultaneous conflicts — the ongoing war in Gaza, the June 2025 twelve-day military confrontation with Iran — have made it the central node of hacktivist activity globally.
The 1,881 unique attack claims recorded against Israeli targets in 2025 represent a 21 percent increase over 2024's already elevated 1,550, following the National Cyber Directorate's own finding of a 55 percent year-on-year increase in attack volume. The primary hacktivist groups targeting Israel included the pro-Iranian Arabian Ghosts, Black Ember, and the pro-Palestinian Mr Hamza, alongside Russia-aligned NoName057(16) — which, across all countries, ranked as the top hacktivist actor globally in 2025 by volume. The alignment of pro-Iranian and pro-Russian hacktivism against a single target is itself an analytical signal: when geopolitical adversaries with otherwise limited coordination find convergent hacktivist causes, the result is a sustained, multi-front digital pressure campaign against a common focal point.
The attack methodology documented in Radware's report reflects broader shifts in the hacktivist ecosystem. DDoS attacks surged 168 percent globally in 2025 compared to 2024, with generative AI tools enabling attackers with limited resources to launch large-scale automated campaigns — account takeover attempts, data scraping, repeated login attacks — that are frequently short in duration and therefore difficult to detect manually. Many attacks lasted under a minute, a cadence that defeats manual monitoring and requires automated defensive responses operating in seconds rather than minutes. Government services remained the primary target across all countries, accounting for 38.8 percent of claimed hacktivist attacks globally, as actors seek to disrupt state functions and undermine public confidence rather than simply cause technical damage. Application-layer attacks grew by more than 120 percent over 2024, reflecting a strategic shift toward directly disrupting business systems and organizational processes rather than saturating network capacity.
Israel's cyber defense chief Yossi Karadi has described what he calls a fast-approaching "cyber war" — a framing that, in the context of these numbers, reads less like hyperbole and more like operational assessment. The Shin Bet and National Cyber Directorate reported detecting and foiling hundreds of Iranian cyberattacks targeting senior government and defense officials, academics, and journalists in recent months alone. The question Israel's cyber posture raises for regional and Western analysts is not whether it is being attacked at scale — the data is unambiguous — but whether the concentration of hacktivist activity around a single nation in active military conflict is reshaping the broader hacktivist ecosystem, as groups build and share tooling, coordinate through Telegram channels, and develop operational patterns that will outlast the specific conflicts that motivated them.
