A pro-Palestine cyber-crime gang has resurfaced and has claimed responsibility of a series of attacks on a large oil & petrochemical company in Israel.

CyberAv3ngers logo – a reworked image of the Palestinian flag

CyberAv3ngers have recently started posting on Twitter and Telegram that they are back and that their return “will be much more painful for u than before”.

@CyberAv3ngers pinned twitter message

Their social media feeds at the moment show various posts from news agencies and other sources relating to incidents at the Haifa petrochemical plant where a number of fires occurred in recent years.

Smoke rising from the Haifa chemicals plant – June 2020

CyberAv3ngers are claiming responsibility for the events which led to those fires.

CyberAv3ngers tweets claiming responsibility for Haifa attacks

A series of screenshots suggest that they have infiltrated the SCADA network of the Bazan group – the company which owns and operates the Haifa site.

Images showing remote access to a SCADA system owned by the Bazan group – compromised by CyberAvengers
Screenshots showing access to the PLC ladder logic allowing for reconfiguration of the site operations
One image shows a control panel display with a message from CyberAv3ngers

A further post shows that all the IP addresses which point to the domain belonging to the Bazan group are down, indicating a complete takeover of the web infrastructure.

At the time of writing, this domain is still inaccessible: