Iranian-Linked Hacker Group Handala Claims Cyberattacks on Israeli Military Targets Amid Escalating Conflict
On June 7, 2026, the Iranian-linked hacker group Handala announced via Telegram that it had launched cyberattacks against Israeli military targets, allegedly disrupting signal networks across the country’s radar systems. The group also claimed to have placed Kfar Yona municipality a town in central Israel under a "digital siege," warning that the attacks marked "the beginning of the end" and served as a first warning to Israel and its allies.
The timing of the announcement coincided with a sudden breakdown in the two-month ceasefire between Israel and Iran, as both nations exchanged heavy missile strikes on the same day. Handala has a history of aligning its cyber operations with real-world military actions for maximum psychological impact.
However, cybersecurity firm SOCRadar investigated the claims and found them to be exaggerated. While Handala shared screenshots of an online admin panel for Tadiran Telecom’s Aeonix system a call-routing software used in office telephone systems the evidence did not support a breach of military radar infrastructure. The screenshots depicted an Interactive Voice Response (IVR) setup with Hebrew-language entries, typical of a municipal phone system rather than a defense network.
The conflict between Iran and Israel escalated in February 2026 following Operation Epic Fury, a joint U.S.-Israeli bombing campaign, and intensified after the killing of Iranian Supreme Leader Ali Khamenei. A temporary ceasefire, brokered by Pakistan in April, collapsed on June 7, reigniting hostilities.
Handala has been active since the war’s onset, with confirmed attacks including a data-wiping operation against medical technology firm Stryker Corporation and the alleged breach of FBI Director Kash Patel’s personal Gmail account. While its latest claims remain unverified, researchers note that Iran-linked hackers continue to pose a persistent threat.
Source: https://hackread.com/handala-israeli-radar-hack-evidence-phone-admin-panel/
Kfar Yona Municipality TPRM report: https://www.rankiteo.com/company/socradar
Israeli Military TPRM report: https://www.rankiteo.com/company/israelimod
"id": "isrsoc1781008113",
"linkid": "israelimod, socradar",
"type": "Cyber Attack",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Public Administration',
'location': 'Israel',
'name': 'Kfar Yona Municipality',
'type': 'Government'},
{'industry': 'Telecommunications',
'location': 'Israel',
'name': 'Tadiran Telecom',
'type': 'Corporation'},
{'industry': 'Defense',
'location': 'Israel',
'name': 'Israeli Military',
'type': 'Government'}],
'attack_vector': 'Exploitation of call-routing software (Tadiran Telecom’s '
'Aeonix)',
'date_detected': '2026-06-07',
'date_publicly_disclosed': '2026-06-07',
'description': 'On June 7, 2026, the Iranian-linked hacker group Handala '
'announced via Telegram that it had launched cyberattacks '
'against Israeli military targets, allegedly disrupting signal '
'networks across the country’s radar systems. The group also '
'claimed to have placed Kfar Yona municipality under a '
"'digital siege.' Cybersecurity firm SOCRadar investigated the "
'claims and found them to be exaggerated, with evidence '
'pointing to a breach of a municipal phone system rather than '
'military infrastructure.',
'impact': {'operational_impact': 'Disruption of municipal communication '
'systems',
'systems_affected': ['Municipal phone system (IVR)',
'Potential military signal networks '
'(unverified)']},
'initial_access_broker': {'entry_point': 'Tadiran Telecom’s Aeonix system'},
'investigation_status': 'Ongoing (claims unverified)',
'motivation': ['Geopolitical', 'Psychological Impact'],
'post_incident_analysis': {'root_causes': 'Exploitation of vulnerable '
'call-routing software'},
'references': [{'date_accessed': '2026-06-07',
'source': 'Telegram (Handala announcement)'},
{'source': 'SOCRadar Investigation'}],
'response': {'third_party_assistance': 'SOCRadar (investigation)'},
'threat_actor': 'Handala',
'title': 'Iranian-Linked Hacker Group Handala Claims Cyberattacks on Israeli '
'Military Targets',
'type': ['Cyberattack', 'Data Breach']}