{"id":5180,"date":"2026-10-13T10:05:33","date_gmt":"2026-10-13T10:05:33","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5180"},"modified":"2026-10-13T10:05:36","modified_gmt":"2026-10-13T10:05:36","slug":"mercantile-discount-bank-ddos-4-dangerous-tools-exposed","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/mercantile-discount-bank-ddos-4-dangerous-tools-exposed\/","title":{"rendered":"Mercantile Discount Bank DDoS: 4 Dangerous Tools Exposed"},"content":{"rendered":"\n

Screenshots from a hacktivist operation show mercantile.co.il<\/mark><\/strong>, the public website of Mercantile Discount Bank, timing out from more than two dozen monitoring locations on September 10, 2026. The Mercantile Discount Bank DDoS push, branded #OpZionistV2<\/mark><\/strong>, shows at least four different attack tools and a posting window of just over three hours.<\/p>\n\n\n\n

The material reviewed for this Mercantile Discount Bank DDoS report contains no statement from the bank, so everything below rests on the operation’s own screenshots. They are detailed enough to show how the crew works, and where the proof stops.<\/p>\n\n\n\n

The Announcement: Target, Time and Message<\/h2>\n\n\n\n

The announcement behind the Mercantile Discount Bank<\/mark><\/strong> DDoS push opened with a banner post headed NEW TARGET RELEASED. It named Mercantile Discount Bank and described it as a wholly owned subsidiary of Israel Discount Bank<\/mark><\/strong>, a group the post places among the top three in the country. It adds that the bank’s platform serves retail clients, small businesses and municipalities.<\/p>\n\n\n\n

\"Figure
Figure 1 : Mercantile Discount Bank DDoS announcement titled NEW TARGET RELEASED under the #OpZionistV2 banner, listing target info, order time, ports 80 and 443 and the group’s message<\/figcaption><\/figure>\n\n\n\n

A second block set the schedule. It lists an order time of 15:00, a time zone entry of 08:00 GMT and the date 10\/09\/2026. Below that sit the site address, ports 80 and 443, and an ISP entry reading Israel Discount Bank Ltd. The IP address is blacked out, and a line urges participants to activate a VPN.<\/p>\n\n\n\n

The message was short: “Stop Ki**ings People, We Are Watching Your Action<\/mark><\/strong>.” The post then thanked “all our Allies,” which points to a coalition effort rather than a single operator.<\/p>\n\n\n\n

Inside the Mercantile Discount Bank DDoS Evidence<\/h2>\n\n\n\n

The proof arrived as forwarded reports from check-host.net, a public service that tests a site from probes around the world. In the first report, stamped 07:01:46 UTC, nearly every row reads connection timed out. The list spans more than two dozen locations, from Vienna and S\u00e3o Paulo to Tokyo and Jakarta, and a few Iranian probes return connection refused.<\/p>\n\n\n\n

\"Figure
Figure 2 : Mercantile Discount Bank DDoS check-host.net report showing connection timed out results beside a CYBERNETIC WOLF terminal aimed at mercantile.co.il<\/figcaption><\/figure>\n\n\n\n

The same screenshot carries a terminal banner reading CYBERNETIC WOLF<\/mark><\/strong>, with the target URL and a Starting attack line, so the run and the report were captured together. The report’s 07:01:46 UTC stamp falls about an hour ahead of the 08:00 GMT time in the notice.<\/p>\n\n\n\n

An early, uniform result like that fits more than one explanation. Operators may have tested before the scheduled start, or the site may already filter traffic from abroad. A later report, stamped 08:09:35 UTC and visible in Figure 4, shows the same pattern for Vienna, S\u00e3o Paulo, Sofia, Vancouver, Larnaca and Helsinki.<\/p>\n\n\n\n

After the 14:00 announcement, the Mercantile Discount Bank DDoS trail continued with nine proof posts between 14:17 and 17:15, each pairing a monitoring link with a screenshot or video. Those posts drew between 45 and 86 views each.<\/p>\n\n\n\n

The RipperSec Fingerprint<\/h2>\n\n\n\n

One image in the set is pure branding: the RipperSec emblem, a skull framed by crescents, with the group’s name in Latin and Arabic script. The same emblem sits on one of the forwarded tool screenshots shown further down.<\/p>\n\n\n\n

\"Figure
Figure 3 : RipperSec emblem, a skull framed by crescents with the group name in Latin and Arabic script, linked to the Mercantile Discount Bank DDoS material<\/figcaption><\/figure>\n\n\n\n

Threat intelligence firms describe RipperSec as a pro-Palestinian hacktivist group that emerged in June 2023. Its model leans on volunteers and public tools rather than custom infrastructure. Cyble<\/mark><\/a><\/strong> tracks its aliases and tooling, while Radware<\/mark><\/a><\/strong> documented MegaMedusa, an open Layer 7 tool made by a group member, and counted 196 DDoS attacks the group listed between January and August 2024.<\/p>\n\n\n\n

For earlier coverage, see [https:\/\/cyberasia.io\/actor\/rippersec\/<\/mark><\/a><\/strong>: related CyberAsia.io article on RipperSec DDoS campaigns].<\/p>\n\n\n\n

Four Tools Aimed at One Homepage<\/h2>\n\n\n\n

Four tool interfaces appear in the Mercantile Discount Bank DDoS posts: CYBERNETIC WOLF, PHANTOM, PHOENIX and MegaMedusa. Four setups inside one three-hour window fit the community-driven model researchers describe for the group.<\/p>\n\n\n\n

PHANTOM and the FASTRIS Method<\/h2>\n\n\n\n

In Figure 4, a phone terminal shows an interface labeled PHANTOM reporting an attack launched against the bank’s homepage. The method is listed as FASTRIS and the run time as 120 seconds. The attached proof link leads to another timeout report.<\/p>\n\n\n\n

\"Figure
Figure 4 : Mercantile Discount Bank DDoS proof post with a PHANTOM terminal launching the FASTRIS method for 120 seconds beside a check-host.net timeout report<\/figcaption><\/figure>\n\n\n\n

PHOENIX and ECONNRESET<\/h2>\n\n\n\n

Figure 5 pairs PHOENIX<\/mark><\/strong> output with a world map shaded red. Per-location bars for Sofia, S\u00e3o Paulo, Zurich, Larnaca and Nuremberg all read ECONNRESET, an error meaning the remote side dropped the connection mid-request.<\/p>\n\n\n\n

\"Figure
Figure 5 : Mercantile Discount Bank DDoS PHOENIX output with ECONNRESET bars for Sofia, S\u00e3o Paulo, Zurich, Larnaca and Nuremberg over a red world map<\/figcaption><\/figure>\n\n\n\n

MegaMedusa and Soldier #11<\/h2>\n\n\n\n

Figure 6 shows a terminal printing MegaMedusa<\/mark><\/strong> Attacking above long runs of request timed out lines. A separate post carries the credit line Soldier #11, which suggests participants are numbered and credited for their runs.<\/p>\n\n\n\n

\"Figure
Figure 6 : Mercantile Discount Bank DDoS posts with a MegaMedusa terminal, a timeout report and the credit line Soldier #11<\/figcaption><\/figure>\n\n\n\n

The tool output and the listed ports point to application-layer HTTP flooding, not a bandwidth-saturating volumetric attack. In plain terms, the crew tried to exhaust the web server’s capacity to answer requests.<\/p>\n\n\n\n

The Target and Its Customers<\/h2>\n\n\n\n

Mercantile Discount Bank has been wholly owned by Israel Discount Bank since 1993, according to the parent’s group structure page<\/mark><\/a><\/strong>. The bank’s own profile page<\/mark><\/a><\/strong> says it runs dozens of branches across Arab towns and cities in Israel. A prolonged outage from the Mercantile Discount Bank DDoS campaign would therefore reach many customers in those communities.<\/p>\n\n\n\n

What the Screenshots Cannot Show<\/h2>\n\n\n\n

Timeouts from probes abroad are not the same as an outage for customers inside Israel. Some Israeli websites restrict access from abroad, so uniform timeouts can have more than one cause.<\/p>\n\n\n\n

The reports also test only the public homepage. They say nothing about online banking logins, mobile apps or branch systems, and they include no latency curve, HTTP error code<\/mark><\/strong> or recovery time. The bank’s own traffic logs would settle the question.<\/p>\n\n\n\n

Until the bank or a monitor inside Israel publishes measurements, the safest reading of the Mercantile Discount Bank DDoS episode is narrow: a coordinated attempt against the homepage, documented with timeouts from outside the country.<\/p>\n\n\n\n

FAQ<\/h2>\n\n\n\n

Q1 : Did the Mercantile Discount Bank DDoS attack take the bank offline?<\/mark><\/strong><\/p>\n\n\n\n

The screenshots show timeouts from many probes outside Israel, but they test only the homepage. Without the bank’s own traffic data, customer-level impact cannot be measured.<\/p>\n\n\n\n

Q2 : Was customer data exposed in the Mercantile Discount Bank DDoS attack?<\/mark><\/strong><\/p>\n\n\n\n

Nothing in the material points to data access. A flood targets availability, though CISA guidance notes that floods can distract defenders from other intrusions.<\/p>\n\n\n\n

Q3 : What kind of attack was it?<\/mark><\/strong><\/p>\n\n\n\n

The tools and ports 80 and 443 point to a Layer 7 HTTP flood, which drains server capacity with request volume instead of filling bandwidth.<\/p>\n\n\n\n

Q4 : What should site operators do against floods like this?<\/mark><\/strong><\/p>\n\n\n\n

Enroll in upstream DDoS mitigation, rate limit abusive HTTP clients, rehearse a response plan and test availability from several regions. The joint CISA, FBI and MS-ISAC guide<\/mark><\/a><\/strong> covers each step.<\/p>\n\n\n\n

Educational Notice<\/h2>\n\n\n\n

This article is published for educational and cyber threat intelligence purposes only. CyberAsia.io does not endorse or encourage unauthorized access to, or disruption of, any system. All findings come from the screenshots and public reporting cited above.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Screenshots from a hacktivist operation show mercantile.co.il, the public website of Mercantile Discount Bank, timing out from more than two dozen monitoring locations on September 10, 2026. The Mercantile Discount Bank DDoS push, branded #OpZionistV2, shows at least four different attack tools and a posting window of just over three hours. The material reviewed for […]<\/p>\n","protected":false},"author":3,"featured_media":5181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[1651,2596,2674,1656,1184,2677,482,773,2673,14,2616,84,2672,2676,1664,2671,2505,2681,1649,2678,1256,2675,2007,2347,1263,1944,2593,2680,1245,2521,1160,2679],"threat_actors":[409],"class_list":["post-5180","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ddos","tag-ancaman-siber","tag-ataque-ddos","tag-bank-cyber-attack","tag-berita-keamanan-siber","tag-ciberseguridad","tag-cyber-security-indonesia","tag-cyber-threat-intelligence","tag-cybersecurity-news","tag-dangerous-hacking-tools","tag-ddos-attack","tag-ddos--2","tag-distributed-denial-of-service","tag-financial-sector-security","tag-keselamatan-digital","tag-keselamatan-siber","tag-mercantile-discount-bank","tag-seguranca-cibernetica","tag-seguridad-informatica","tag-serangan-ddos","tag-2678","tag-1256","tag-2675","tag-2007","tag-2347","tag-1263","tag-1944","tag-2593","tag-2680","tag-1245","tag-2521","tag-1160","tag-2679","threat_actor-rippersec"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=5180"}],"version-history":[{"count":3,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5180\/revisions"}],"predecessor-version":[{"id":5190,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5180\/revisions\/5190"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media\/5181"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=5180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/categories?post=5180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/tags?post=5180"},{"taxonomy":"threat_actor","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors?post=5180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}