Open Nav
Sign Up

Karma Below 80 Performs cyber attack on Prominent Israeli Engineering and Construction Company

Roy Golombick

April 15, 2024

A well-known Tel Aviv-based engineering and construction company was compromised in mid March in a significant supply-chain-based cyber attack conducted by the group known as Karma Below 80. 

Karma Below 80, a group claiming to be anti-Zionist Jewish hackers, is notorious for its politically motivated attacks and strong opposition to Israeli policies and certain political figures.

About Karma Below 80

Karma Below 80 engages in sophisticated cyber tactics, including the deployment of ransomware-as-a-service (RaaS) named Karma. This malware is designed to encrypt data on infected machines quickly, selectively sparing certain essential system files to maintain the operational integrity of the system while still achieving its disruptive goals. The group has been active with various tactics since as early as 2004, when they were noted for exploiting wireless network vulnerabilities through KARMA attacks, a type of “evil twin” attack that deceives devices into connecting to rogue Wi-Fi access points controlled by the attackers.

Details of the Attack

The attack on the engineering and construction company was executed through an initial breach of the company’s supply chain through their IT provider, which had surprisingly weak security defenses. Karma Below 80 exploited a weak VPN password to first gain access to the IT provider’s systems. Once inside, the group infiltrated the company’s Google Drive, where they proceeded to delete and modify critical files.

Despite the company’s stringent security protocols, especially concerning its military-related operations, the attackers were able to bypass these defenses by targeting the less secure networks managed by third-party vendors. Luckily, the company’s most sensitive networks were secluded from the internet, keeping them secure from the attack, thus preventing a potentially more disastrous outcome.

Response and Recovery

Following the attack, the engineering firm enlisted OP Innovate’s services. Our specialists diagnosed and addressed several vulnerabilities in the existing security setup, such as an overload of false positives from their endpoint detection and response (EDR) system coupled with the inefficient use of multiple EDR solutions in parallel. 

Key Takeaways

The incident underscores the critical importance of robust cybersecurity measures and the risks posed by inadequate third-party vendor security. Recommendations for improving security include:

1. Enhancing oversight and control over third-party IT services, especially those with high levels of access and privilege to the system.

2. Using a unified and effective EDR solution rather than multiple conflicting systems.

3. Keeping sensitive data offline and isolated from internet-connected networks.

4. Regularly updating and auditing all security measures to ensure they handle the latest threats effectively.

5. Consider using a reputable third-party option for backing up your corporate cloud application data (Google Workspace, Microsoft 365 etc) against data loss or corruption.

6. Training employees to be vigilant about cybersecurity in both their professional and personal online activities.

This attack serves as a stark reminder of the vulnerabilities that can exist even within well-protected systems, particularly those involving third-party vendors. By understanding the methods used by groups like Karma Below 80 and implementing the lessons learned from such incidents, organizations can better safeguard themselves against future cyber threats.

Resources highlights

Critical Cisco ISE Vulnerabilities Lead to Unauthenticated RCE (CVE-2025-20281 & CVE-2025-20282)

On June 25, 2025, Cisco disclosed and patched two critical remote code execution (RCE) vulnerabilities: CVE-2025-20281 and CVE-2025-20282, affecting its widely deployed Identity Services Engine…

Read more >

CVE-2025-20281 & CVE-2025-20282

Critical Vulnerability in MegaRAC BMC Added to CISA’s KEV: CVE-2024-54085

On June 25, 2025, CISA added CVE‑2024‑54085, a critical authentication bypass vulnerability in the MegaRAC SPx Baseboard Management Controller (BMC) firmware, to its Known Exploited…

Read more >

CVE-2024-54085

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding a sophisticated malware campaign dubbed “UMBRELLA…

Read more >

umbrella stand fortinet

CVE-2025-49144: Privilege Escalation in Notepad++ Installer Enables Full SYSTEM Access

A critical local privilege escalation vulnerability in the Notepad++ v8.8.1 installer allows attackers to escalate to NT AUTHORITY\SYSTEM using binary planting techniques. Tracked as CVE-2025-49144,…

Read more >

CVE-2025-49144

Our Red Team’s Favorite Penetration Testing Tools in 2025 (And How We Use Them)

When it comes to red team operations, the tools you choose can make or break the engagement. From initial reconnaissance to post-exploitation, having a streamlined,…

Read more >

pentesting tools - op

New Linux Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Enable Full Root Access in Seconds

Security researchers have uncovered a critical privilege escalation chain in major Linux distributions that allows any local user with a session (SSH or GUI) to…

Read more >

CVE-2025-6018, CVE-2025-6019
Under Cyber Attack?

Fill out the form and we will contact you immediately.