Pro-Palestinian Hacker Group Targets Israeli Think Tank Site, Server Errors Reported Across 40+ Locations

The official website of the Economic Cooperation Foundation (ECF), an Israeli policy think tank, reportedly suffered widespread access disruptions over the past weekend. According to independent uptime monitoring, ecf.org.il could not be reached normally from dozens of locations around the world, with most connection attempts resulting in server failures or timeouts.

The disruption surfaced almost simultaneously with a post on a Telegram channel operating under the name Yemen Cyber Group, which identified the site as a target and tagged it with the hashtags #OpIsrael and #YemenCyberGroup. However, a direct link between the group’s activity and the technical cause of the outage on the ECF site has not been independently established.

What Happened

A status check performed on Monday, August 24, 2026, offers a fairly clear picture of the scale of the disruption affecting ecf.org.il. Of the dozens of monitoring points spread across multiple continents, nearly all reported failures to access the site, with various types of connection errors.

Several locations, including Vienna (Austria), Milan (Italy), London (UK), Meppel (Netherlands), Maribor (Slovenia), and Kyiv (Ukraine), logged a “connection reset by peer” message, which technically indicates that a connection was established but then forcibly terminated by the destination server. Meanwhile, other locations such as São Paulo (Brazil), Vancouver (Canada), Frankfurt and Nuremberg (Germany), Hong Kong, Warsaw (Poland), Bucharest (Romania), Moscow and Saint Petersburg (Russia), Stockholm (Sweden), and Istanbul (Turkey) instead recorded an HTTP 503 Service Unavailable error, a code commonly seen when a server runs out of capacity to process incoming requests.

A significant number of monitoring points also logged “connection timed out” results, including from Paris, Helsinki, Sofia, several cities in Iran (Isfahan, Qom, Shiraz, Tehran), India (Delhi, Kolkata), Japan (Tokyo), Singapore, Spain (Barcelona, Madrid), and Atlanta in the United States. Notably, two monitoring points located directly in Israel, Netanya and Tel Aviv, also recorded the same type of timeout failure.

Every monitoring point that successfully completed DNS resolution pointed to the same IP address, 104.145.235.231, indicating that the disruption was centered on the server infrastructure serving the domain rather than caused by scattered routing issues.

On the same day, an additional screenshot showed the ecf.org.il page displaying a “Service Unavailable” message, stating that the server was temporarily unable to handle requests due to maintenance downtime or capacity problems. The page that loaded showed none of the institution’s usual content, only a brief error message indicating that the system was unable to serve visitors as expected.

Who Is Affected

The Economic Cooperation Foundation is known as an independent Israeli policy think tank focused on economic policy planning and regional cooperation. As an institution operating in the public policy and economic diplomacy space, ECF is frequently referenced by policymakers and researchers tracking developments in regional economic relations across the Middle East.

Disruption to the official website of an institution like this has the potential to hinder access for the public, partner organizations, and researchers seeking publications, research reports, or institutional information that is normally available openly on the site.

Context and Background of the Group’s Statement

The post accompanying the #OpIsrael hashtag places the incident within a broader context. OpIsrael itself is not a new term in the global hacktivism landscape. It is a recurring cyber campaign label used periodically by various hacker groups to target digital infrastructure affiliated with Israel, particularly during periods tied to the region’s geopolitical situation.

The post accompanying the screenshot of the downed site referred to ecf.org.il as an “enemy site” and included a link to a third-party uptime check report as supporting evidence for its statement. The group identifying itself as Yemen Cyber Group also included a brief description of ECF as an Israeli policy institution in the post.

So far, the statement regarding the group’s involvement in causing the disruption to the ECF site comes directly from the group’s own post. No official statement has been issued by ECF or Israeli cybersecurity authorities confirming or denying a connection between the post and the technical cause of the outage recorded by the uptime monitoring system.

Technical Details

From a technical standpoint, the combination of error codes recorded offers several clues about the possible cause of the disruption. The consistent appearance of HTTP 503 errors across widely dispersed geographic locations suggests the backend server may have been overwhelmed by request volume, a pattern commonly associated with distributed denial-of-service (DDoS) incidents. That said, similar conditions can also result from internal infrastructure failures, server misconfiguration, or unscheduled system maintenance, as the error message displayed on the site itself suggests, referencing possible “maintenance downtime or capacity problems.”

The variety of error types observed, ranging from connection resets and timeouts to 503 server errors, also points to inconsistent server responses to incoming requests, which could indicate a system struggling under high traffic volume or in the process of a gradual recovery.

Response times recorded at locations that did manage to connect to the server, such as 4.640 seconds from São Paulo and 5.147 seconds from Istanbul, were also far slower than the typical response time of a healthy website, which is usually under one second.

Potential Impact

If the disruption is ultimately found to have resulted from deliberate cyber activity, the impact would extend beyond mere access inconvenience. Policy institutions like ECF could face reputational risk, disrupted communication with international partners, and potential knock-on effects on other digital services sharing infrastructure with the main site.

Incidents like this also serve as a reminder that policy and research institutions, often considered lower-risk targets compared to financial or government institutions, can still become targets in hacktivist campaigns, particularly during periods of heightened geopolitical tension in a given region.

Response and Mitigation

As of this writing, no official statement has been published by ECF regarding the status of its website services or any recovery measures currently underway. CyberAsia.io‘s editorial team will continue to monitor further developments, including any official confirmation from the institution or relevant cybersecurity authorities, and will update this article as additional relevant information becomes available.

For other organizations and institutions with a similar public profile, this incident may serve as a useful case for reviewing server infrastructure capacity, implementing layered DDoS mitigation systems, and preparing responsive crisis communication plans in the event of sudden digital service disruptions.

Conclusion

The access disruption affecting ecf.org.il shows a technical pattern consistent with high traffic pressure on the server, evident in the combination of 503 error codes and various types of connection failures reported from more than 40 monitoring locations worldwide. The incident coincided with a post from a group identifying itself as Yemen Cyber Group, which included the #OpIsrael hashtag in its messaging.

For now, the exact connection between the group’s activity and the technical cause of the disruption to ECF’s systems remains pending confirmation from relevant authorities. The situation underscores the importance of careful interpretation when assessing digital service disruptions, while also serving as a reminder of the ongoing dynamics of hacktivist campaigns amid regional geopolitical tension.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.