Iranian-Linked Hacker Group Handala Claims Cyberattacks on Israeli Military Targets Amid Escalating Conflict On June 7, 2026, the Iranian-linked hacker group Handala announced via Telegram that it had launched cyberattacks against Israeli military targets, allegedly disrupting signal networks across the country’s radar systems. The group also claimed to have placed Kfar Yona municipality a town in central Israel under a "digital siege," warning that the attacks marked "the beginning of the end" and served as a first warning to Israel and its allies. The timing of the announcement coincided with a sudden breakdown in the two-month ceasefire between Israel and Iran, as both nations exchanged heavy missile strikes on the same day. Handala has a history of aligning its cyber operations with real-world military actions for maximum psychological impact. However, cybersecurity firm SOCRadar investigated the claims and found them to be exaggerated. While Handala shared screenshots of an online admin panel for Tadiran Telecom’s Aeonix system a call-routing software used in office telephone systems the evidence did not support a breach of military radar infrastructure. The screenshots depicted an Interactive Voice Response (IVR) setup with Hebrew-language entries, typical of a municipal phone system rather than a defense network. The conflict between Iran and Israel escalated in February 2026 following Operation Epic Fury, a joint U.S.-Israeli bombing campaign, and intensified after the killing of Iranian Supreme Leader Ali Khamenei. A temporary ceasefire, brokered by Pakistan in April, collapsed on June 7, reigniting hostilities. Handala has been active since the war’s onset, with confirmed attacks including a data-wiping operation against medical technology firm Stryker Corporation and the alleged breach of FBI Director Kash Patel’s personal Gmail account. While its latest claims remain unverified, researchers note that Iran-linked hackers continue to pose a persistent threat.

Handala Hacktivist Group Exposes Israeli Drone Commander in Major Data Breach On April 7, the cyber-activist collective Handala announced a significant data breach, revealing the identity and classified operations of Vered Haimovich, a retired Israeli Air Force (IAF) colonel and commander of the secretive "Squadron 166." According to the leak, Haimovich was personally appointed by Eyal Zamir, Director General of Israel’s Ministry of Defense, to oversee the unit, which serves as the central hub for planning and executing drone strikes targeting strategic locations in Iran. The breach also ties Haimovich to Elbit Systems, where he allegedly leads the development of the "Hermes" drone program, a high-priority unmanned aerial vehicle (UAV) project. Handala’s statement included a cryptic reference to a past incident in Uzbekistan, accusing Haimovich of accepting €40,000 in exchange for access to Elbit’s surveillance systems an alleged espionage act that the group claims set the stage for their current disclosures. In a first-of-its-kind exposure, Handala released an image of the core Hermes drone development team, breaking years of strict secrecy surrounding the project. The group framed the leak as the opening salvo in a broader campaign to uncover hidden aspects of Israel’s military and security operations, warning that additional names and details would be published soon. The breach underscores the growing threat of hacktivist-driven intelligence leaks targeting state-backed defense programs.

Iran-Linked Cyberattacks Escalate Following U.S.-Led Strike on Iranian Leadership Following a U.S.-led military operation on February 24 that resulted in the assassination of Iranian Supreme Leader Ayatollah Ali Khamenei, Iran-backed hackers have intensified cyberattacks against Israel, the U.S., and Gulf nations, targeting critical infrastructure and surveillance systems. Israeli cybersecurity firm Check Point Software reported that Iranian-linked hackers compromised two types of surveillance cameras widely used in Israel, Qatar, Bahrain, and other Middle Eastern countries, likely to assess missile-related damage. Meanwhile, Palo Alto Networks’ Unit 42 tracked dozens of pro-Iran hacktivist groups launching attacks since February 28, including disruptions to Israeli payment systems and Kuwaiti government websites. One group, Handala linked to Iran’s Ministry of Intelligence and Security claimed responsibility for attacks on an Israeli oil and gas company and the shutdown of Jordanian gas stations. While some claims remain unverified, Jordan’s cybersecurity agency confirmed thwarting an Iranian cyberattack on wheat silo management systems. Despite IDF strikes targeting IRGC cyber command centers, experts warn that proxy groups and ideologically aligned actors may continue operations. Lt. Gen. Charles Moore, former deputy commander of U.S. Cyber Command, stated that while the strikes will degrade Iran’s cyber capabilities, decentralized attacks by proxies including those based in Russia will likely persist. This tactic complicates attribution and response efforts. As Alexander Leslie of Recorded Future noted, cyber operations in modern conflict no longer require physical presence in Iran, allowing attacks to continue despite military setbacks. The escalation underscores the growing role of cyber warfare in geopolitical tensions.

The escalating tensions between Iran and Israel have led to an unprecedented surge in hacktivist cyber operations, targeting Israeli government systems, energy infrastructure, financial institutions, and defense contractors. The attacks have compromised critical systems across multiple sectors, including water treatment facilities, satellite communications, judicial systems, and emergency alert networks. The hacktivists have demonstrated capabilities to compromise industrial control systems, deploy custom ransomware, and conduct psychological warfare through targeted doxxing campaigns.

Israeli officials have warned citizens to disconnect internet-connected security cameras due to concerns that Iran may be exploiting them to gather real-time intelligence and adjust missile targeting. Iranian actors have attempted to access private surveillance systems to evaluate the impact of their strikes. Surveillance cameras have become an attractive espionage tool in modern warfare, used to monitor troop movements, air defense positions, and critical infrastructure. This highlights the vulnerabilities in internet-connected cameras, which can be exploited by hackers.