{"id":5191,"date":"2026-10-13T12:25:53","date_gmt":"2026-10-13T12:25:53","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5191"},"modified":"2026-10-13T12:25:56","modified_gmt":"2026-10-13T12:25:56","slug":"yemen-cyber-group-targets-6-israeli-site","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/yemen-cyber-group-targets-6-israeli-site\/","title":{"rendered":"Yemen Cyber Group Targets 6 Israeli Sites: Failures Revealed"},"content":{"rendered":"\n

Six Israeli business websites, from an airport duty free pre-order portal to a cruise line’s regional site, displayed error or maintenance pages in early October 2026, and Yemen Cyber Group<\/mark><\/strong> published a screenshot of each one under its #OpIsrael banner.<\/p>\n\n\n\n

The screens range from 502 Bad Gateway and Gateway Timeout to 500 errors<\/mark><\/strong> and a database connection failure, with one Hebrew maintenance notice mixed in. Nothing in the set points to stolen records or defaced pages. The captures document availability only: sites that did not answer when someone tried to open them.<\/p>\n\n\n\n

\"Figure
Figure 1 : Yemen Cyber Group outage posts showing the dutyfree.co.il maintenance page and the beautycare.co.il 502 Bad Gateway error<\/figcaption><\/figure>\n\n\n\n

Yemen Cyber Group Target List: Six Sites, Six Failure Screens<\/h2>\n\n\n\n

The main posts follow one template: an “Enemy site down (IL)” caption, the site address, a Check-Host<\/mark><\/strong> report link, a short business description and hashtags such as #OpIsrael and #YemenCyberGroup.<\/p>\n\n\n\n

Duty Free is the odd entry. The capture of its official pre-order<\/mark><\/a><\/strong> site shows a Hebrew maintenance notice rather than a server error, and the translation in the post promises a return within minutes. Operators often switch on holding pages like this on purpose, so a planned upgrade cannot be ruled out.<\/p>\n\n\n\n

MSC Cruises Israel and Tokman showed clearer signs of a struggling backend. The cruise line’s Israeli site<\/mark><\/a><\/strong> returned a gateway timeout, meaning a front server waited for an application server that never replied. Tokman displayed a large 500 graphic first and, in a reply less than an hour later, a plain internal error page saying staff had been alerted.<\/p>\n\n\n\n

\"Figure
Figure 2 : Yemen Cyber Group posts showing the msccruises.co.il Gateway Timeout, the tokman.co.il 500 error and a follow-up internal error page<\/figcaption><\/figure>\n\n\n\n

How Yemen Cyber Group Presents Its Outage Posts<\/h2>\n\n\n\n

Yemen Cyber Group brands its feed with a masked figure in a black-and-white checkered scarf above red block lettering (Figure 3). Audience numbers are small, with view counters between 72 and 102. Check-Host, the free tool behind the report links, tests a site from servers worldwide, so a failure can be judged global or local, though each report reflects only the moment it was run.<\/p>\n\n\n\n

#OpIsrael<\/mark><\/strong> is an older banner. Hacktivist collectives have attached it to campaigns against Israeli websites since 2013, and targets tend to be whatever is visible and reachable. These six fit that pattern, and none is a government portal. Yemen Cyber Group’s name points to Yemen, but the posts reviewed say nothing about where its operators work.<\/p>\n\n\n\n

Related: [INTERNAL LINK<\/strong><\/mark><\/a>: earlier CyberAsia.io coverage of Yemen Cyber Group and #OpIsrael].<\/p>\n\n\n\n

\"Figure
Figure 3 : Yemen Cyber Group logo with a masked figure in a black-and-white checkered scarf above red lettering on a black background<\/figcaption><\/figure>\n\n\n\n

What the Error Codes Show, and What They Do Not<\/h2>\n\n\n\n

A 502<\/mark><\/strong> from nginx, as on BeautyCare and Medton Hedim, means the front web server was alive but the application behind it returned nothing usable. A 504, as on MSC Cruises Israel, means the wait ran out. Both are classic symptoms of an overloaded or stalled backend, which is also what a Layer 7 HTTP flood tries to produce.<\/p>\n\n\n\n

The AllTest captures are the most informative. Cloudflare’s page marks the visitor’s browser and its Amsterdam edge as working and only the origin host as failing, so the delivery layer held while the origin stopped answering in time (error 524)<\/mark><\/strong>. A follow-up screenshot shows “Error establishing a database connection,” the standard WordPress message when a site cannot reach its database. That fits an exhausted server, but also a crashed database or a hosting fault.<\/p>\n\n\n\n

Here is the limit of the evidence. Yemen Cyber Group’s posts name no attack method, traffic volume or duration, and a Check-Host link only captures the instant it was run. Every error shown is a server-side failure, yet none identifies its cause, so the outages are documented and the cause is not.<\/p>\n\n\n\n

\"Figure
Figure 4 : Yemen Cyber Group posts showing the medton-hedim.co.il 502 error, the alltest.co.il Cloudflare timeout and a database connection error<\/figcaption><\/figure>\n\n\n\n

Timeline of the Posts<\/h2>\n\n\n\n

The visible stamps cover at least two days. MSC Cruises Israel was posted at 00:29 under an October 3, 2026 date marker and Tokman at 20:03 that evening. AllTest followed at 19:24 on October 4, matching the 12:21 UTC stamp on its Cloudflare page if post times run on UTC+7. Medton Hedim (17:03) and BeautyCare (21:24) show no date.<\/p>\n\n\n\n

Business Impact: Front Doors Shut, Back Offices Unknown<\/h2>\n\n\n\n

For the companies involved<\/mark><\/strong>, the visible damage stops at the web front end: pre-orders, cruise inquiries, SIM and eSIM purchases, service information and equipment sales inquiries. A prepaid eSIM store or an airport pre-order portal depends on web availability more than most, since customers often order shortly before they travel.<\/p>\n\n\n\n

Whether internal systems, payment flows or customer records were touched is not visible in any capture. No statement from the six companies appeared in the material reviewed, so recovery times are unknown.<\/p>\n\n\n\n

Checklist for Site Operators<\/h2>\n\n\n\n
    \n
  1. Pull origin logs for the failure window and compare request rates, user agents and URLs with a normal day.<\/li>\n\n\n\n
  2. Rate-limit expensive endpoints such as search, login and cart, and cache whatever can be cached.<\/li>\n\n\n\n
  3. Review worker pools and database connection limits for signs of a stalled backend.<\/li>\n\n\n\n
  4. Put a CDN or web application firewall in front of the origin, and test from several regions.<\/li>\n<\/ol>\n\n\n\n

    FAQ<\/h2>\n\n\n\n

    Q1 : Does a 502 or 504 error prove a DDoS attack?<\/mark><\/strong><\/p>\n\n\n\n

    No. Those codes only show that a gateway did not get a usable answer from the server behind it. Traffic floods, crashed applications, failed deployments and hosting faults can all produce the same page, so server logs and traffic graphs are what separate them.<\/p>\n\n\n\n

    Q2 : Were customer records taken in the Yemen Cyber Group outages?<\/mark><\/strong><\/p>\n\n\n\n

    None of the screenshots shows data theft, only pages that would not load. An outage and an intrusion can overlap, though, so operators should review database and access logs for the same window before ruling anything out.<\/p>\n\n\n\n

    Q3 : What should an admin do first after a database connection error?<\/mark><\/strong><\/p>\n\n\n\n

    Confirm the database service is running and reachable, then check connection limits and free disk space. Restore from backup only if the data itself is damaged.<\/p>\n\n\n\n

    Q4 : How can I tell whether a site is down for everyone or only for me?<\/mark><\/strong><\/p>\n\n\n\n

    Run the address through a multi-location checker such as Check-Host and compare results from several countries. A failure everywhere points to the service itself, while one confined to a single region may be routing or filtering.<\/p>\n\n\n\n

    Disclaimer<\/h2>\n\n\n\n

    This article is published for cybersecurity research and education. It reports on publicly posted screenshots and does not endorse unauthorized access to, or attacks on, any system. Organizations named here appear for reporting purposes, and no evidence of data loss at any of them is presented.<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Six Israeli business websites, from an airport duty free pre-order portal to a cruise line’s regional site, displayed error or maintenance pages in early October 2026, and Yemen Cyber Group published a screenshot of each one under its #OpIsrael banner. The screens range from 502 Bad Gateway and Gateway Timeout to 500 errors and a […]<\/p>\n","protected":false},"author":3,"featured_media":5192,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[1656,2003,1184,29,2385,1188,1380,14,12,2633,2683,2637,1657,2381,60,1647,1256,2391,2007,2072,1259,1263,2639,2685,1245,1247,1395,2684,1160,1954],"threat_actors":[2682],"class_list":["post-5191","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ddos","tag-berita-keamanan-siber","tag-berita-keselamatan-siber","tag-ciberseguridad","tag-cyber-attack","tag-cyber-security-news","tag-cybersecurite","tag-cybersicherheit","tag-ddos-attack","tag-hacktivism","tag-israeli-websites","tag-penggodaman-laman-web","tag-peretas-yaman","tag-serangan-siber-israel","tag-siber-guvenlik","tag-threat-intelligence","tag-yemen-cyber-group","tag-1256","tag-2391","tag-2007","tag-2072","tag-1259","tag-1263","tag-2639","tag-2685","tag-1245","tag-1247","tag-1395","tag-2684","tag-1160","tag-1954","threat_actor-yemen-cyber-group"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=5191"}],"version-history":[{"count":6,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5191\/revisions"}],"predecessor-version":[{"id":5202,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5191\/revisions\/5202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media\/5192"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=5191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/categories?post=5191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/tags?post=5191"},{"taxonomy":"threat_actor","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors?post=5191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}