Shortly after the flyers were discovered, the hacker group Handala claimed responsibility for the operation. In a statement, the group said its operatives distributed hundreds of thousands of leaflets across Tel Aviv overnight.
According to their statement, the flyers include direct threats to strike critical infrastructure in Israel, including power stations, refineries and desalination plants, in response to possible attacks on energy infrastructure of the "resistance axis." Israeli security and police officials are verifying the claims while conducting a technical examination of the malicious links.
Iranian intelligence arm in activist disguise
Israeli and American security agencies, alongside international cyber firms, have been tracking the Handala group for an extended period. Though its members present themselves as "independent pro-Palestinian activists," intelligence assessments state unequivocally that the group is an operational cyber arm of Iran's Ministry of Intelligence (MOIS), operating under full sponsorship and funding from the regime in Tehran .
The group's arsenal of operations includes hack-and-leak attacks, breaking into computer systems, stealing sensitive data and publishing it online. The group also engages in doxxing and privacy violations: exposing personal details, addresses, phone numbers and photographs of senior security officials, employees in defense industries and civilians. Handala also conducts sabotage and destructive cyber attempts, including website defacement and deployment of malware to delete data, and wages psychological warfare through the distribution of flyers, threatening messages and coordinated campaigns on social media.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
