Cyber Operations — 2026-04-09

Iran-Linked Handala Hackers Vow to Continue Cyberattacks Against U.S. and Israel Despite Ceasefire

The Handala hacking group, assessed with high confidence by the Justice Department and Unit 42 as a MOIS-operated destructive cyber persona, announced it would pause attacks on U.S. targets during the ceasefire but continue targeting Israel, stating the cyber war did not begin with the military conflict and will not end with any ceasefire. The group previously claimed responsibility for hacking FBI Director Kash Patel's personal email and disrupting Stryker Corporation medical equipment operations. Cybersecurity experts warned that pro-Iranian groups may attempt high-profile operations during the ceasefire window to maintain leverage.

Analysis
Handala's statement that it will pause U.S. attacks but continue targeting Israel creates a split-threat posture that complicates any intelligence coordination around the ceasefire. The group's prior breach of Patel's personal email demonstrated access to senior IC leadership's unclassified communications. The $10M reward the State Department offered for Handala operatives signals the U.S. now treats MOIS cyber personas as tier-one intelligence targets, not merely nuisance actors.

2 sources

Hackers Vow to Continue Cyberattacks Despite Iran-US Ceasefire - Washington Today
Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long - PBS