Israel kept being the world's top target for hacktivist attacks in the first half of 2026, with one in six attacks targeting the country, the Radware H1 2026 Global Threat Report revealed Wednesday.
A hacktivist attack is carried out by non-state actors, often sponsored by states but not officially part of their organization, against selected countries for geopolitical reasons.
According to the report, Israel absorbed 16% of all the hacktivist campaigns, with 784 recorded claims of attacks; the United States was second with 8%, and the United Kingdom was third, while many European countries supporting Ukraine in the war against Russia absorbed a significant number of secondary attacks.
The report pointed out that a spike in attacks of this style was recorded during the war between the US, Israel, and Iran, after seeing these types of attacks hit a record low during the first months of the year.
In comparison to previous years, the first half of 2026 has been one of the lowest recorded, with the peak of hacktivism attacks being reached after the October 7 massacre and the beginning of the Israel-Hamas War, the report noted.
"The most significant finding is not merely that Israel once again ranks first, but that the gap between it and the other countries continues to widen," says Ron Meyran, vice president of Cyber Intelligence at Radware.
"The digital arena has become an inseparable part of every military conflict, and the campaign against Iran demonstrated how quickly dozens of groups can mobilize and act against organizations in Israel," he added.
The report also noted that most hacktivist groups active in the first half of the year were from the pro-Russia, anti-Western collective, with 85% of attacks claimed by groups in the collective. The most active group was NoName057, which accounted for almost 40% of the attacks.
Targeting infrastructure, autonomous systems
The report also noted that the attacks centered on infrastructure, with the main targets being industrial facilities that provide essential services and could pressure public officials.
According to the findings, 37% of the attacks targeted governmental institutions, while other targets included manufacturing services (8%), business (7%), hospitality (6%), and the financial sector (5%).
In terms of the services targeted, the main objective was to disrupt autonomous system numbers (ASNs), with the main companies affected by these attacks being Microsoft (22%), Amazon Web Services (13%), and Google Cloud Platform (7%).
Secondary targets included several European hosting providers, such as Hetzner Online GmbH (8.4%), because their infrastructure is key to supporting Ukrainian and Israeli networks, including uPress, Radware, Hosting Ukraine, and Cellcom.