Unit 8200

Summary

Israel's signals-intelligence unit in the IDF Intelligence Directorate, responsible for collecting signals intelligence and code decryption. Press reporting based on current and former US, European and Israeli officials (The New York Times, 2012) describes a joint US–Israeli operation, Olympic Games, begun in 2006, that built Stuxnet to sabotage high-speed centrifuges at Natanz; Unit 8200 helped develop the payload with the NSA. Neither government has acknowledged it. Flame (The Washington Post, 2012, citing Western officials: jointly developed by the US and Israel) and Duqu (press reports connecting it to the Israeli government, NPR 2015) are linked to Israel, not to this unit by name; Kaspersky treats the Flame group as a separate actor. The IDF said the unit's intelligence, shared with Australia, helped thwart a July 2017 ISIS plot to bomb an Etihad flight from Sydney. A single Western security source told Reuters the unit was involved in developing and testing the 2024 Lebanon pager operation, which other sources attribute to the Mossad. In September 2025 Microsoft disabled Azure storage and AI services used by a unit within Israel's Ministry of Defense after finding evidence that supports elements of The Guardian's reporting that Unit 8200 stored intercepted Palestinian phone calls on Azure.

Attribution

Its cyber operations on record are press-attributed

Hedged, circumstantial or press-only reporting; not established.

• The Media Line, reporting an IDF statement (Own statement, 2018-02-22)
  The IDF acknowledges the unit and one 2018 counter-terror operation
• Reuters (via Cyprus Mail) (Press, 2024-09-18)
  Single-source reporting on the pager attack; no confirmation

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 1

Malware and tools 1

Exploited vulnerabilities 2

Highest CVSS first.

Reporting and advisories 9

• The Register, reporting The New York Times
  US officials confirm Stuxnet was a joint US-Israeli op (1 Jun 2012)
• Reuters
  Lebanon Pager Supply Chain Attack
• IDF statement
  SIGINT tip-off disrupting ISIS Etihad airliner bomb plot (Australia)
• Microsoft
  Update on ongoing Microsoft review (25 Sep 2025) — services to "a unit within the Israel Ministry of Defense" disabled
• The Washington Post (via Atlantic Council)
  U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say (Jun 2012)
• NPR
  Israel-linked spy virus discovered at hotels used for Iran nuclear talks (Jun 2015)
• TechCrunch, reporting The Guardian
  Microsoft cuts cloud services to Israeli military unit over Palestinian surveillance (Sep 2025)
• The Guardian
  Revealed: Microsoft cloud used by Israeli military unit to store Palestinian phone calls (Aug 2025)
• MITRE ATT&CK
  S0603 — Stuxnet (software)