Loading threat actor…
Unit 8200 is the Israel Defense Forces’ elite signals intelligence and cyber unit, widely associated with offensive cyber operations, large-scale surveillance, and advanced intelligence collection. It is commonly linked to Israel’s military intelligence apparatus and is known for combining interception, analysis, and cyber capabilities in support of national security and military objectives. The unit has been reported to operate extensive surveillance programs focused on Palestinian communications in Gaza and the West Bank, including systems designed to collect, store, and analyze very large volumes of mobile phone calls and text messages. Reported capabilities include mass interception, cloud-enabled storage and retrieval of communications, AI-assisted analysis, and risk scoring of messages to support intelligence production. These activities have been associated with identifying persons of interest, supporting operational targeting, and broader monitoring of Palestinian populations. Unit 8200 has also been repeatedly cited in public reporting and expert attribution discussions concerning Israel’s role in highly sophisticated cyber operations. In particular, Israel, through Unit 8200, has been widely speculated to have participated alongside the United States in the Stuxnet operation, the landmark cyber-physical sabotage campaign against Iran’s nuclear program. While official acknowledgment has not been made, this association has contributed to Unit 8200’s reputation as one of the world’s most capable state cyber organizations. Beyond intelligence collection, Unit 8200 is notable for advanced cyber tradecraft and technical depth, and it has produced many alumni who later became prominent figures in the private cybersecurity sector. High-confidence reporting supports its role as a state cyber and intelligence actor primarily oriented toward espionage, surveillance, and operational support rather than criminal monetization or ransomware activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as background in a discussion of Microsoft and Israel-related controversy; no malware/ransomware campaign or threat activity details are provided in this reference.
Unit 8200 is known as the elite cyber group of the Israel Defense Forces, specializing in cyber operations, intelligence gathering, and offensive cyber capabilities.
Israeli military intelligence unit conducting large-scale signals intelligence and mass surveillance of Palestinians, storing intercepted calls in Microsoft Azure and using the resulting intelligence to support military operations, including target research for airstrikes.
Unit 8200, the Israeli military intelligence unit, is believed to have collaborated with the NSA's Equation Group in the development and deployment of Stuxnet as part of Operation Olympic Games. Their role included intelligence gathering, targeting, and possibly testing the malware on similar centrifuge equipment. Unit 8200 is recognized for its advanced cyber capabilities and involvement in offensive cyber operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.