Cybersecurity — 2026-04-11
Iranian Hackers Declare Ceasefire Will Not End Cyber Operations Against Israel and US
Iran-linked hacking group Handala announced the April 7 ceasefire would not stop retaliatory cyberattacks, stating it was temporarily postponing operations against the US but would continue targeting Israel. Handala claimed breaches of Iron Dome and radar systems, sent 500,000 threatening texts to Israelis, and released identities of 80 Unit 8200 officers with $10,000 bounties. FDD assessed Handala operates as a front for Iran's MOIS. The ceasefire creates a window where both sides may accelerate intelligence collection through cyber means.
Analysis
Handala's declaration that cyber operations continue despite the ceasefire creates a parallel conflict track the Islamabad talks do not address. Iran can maintain plausible deniability on cyber while negotiating kinetic de-escalation: the ceasefire covers bombs, not bytes. The Unit 8200 officer doxxing with bounties represents a shift from disruption to targeting of individual intelligence personnel.
3 sources
- Hackers: Ceasefire will not put an end to US cyberattacks - NWA Democrat-Gazette
- 6 Things To Know About Handala — Tehrans Hackers Making Front Page News - FDD
- Pro-Palestine group publishes names of Unit 8200 operatives, posts $10,000 bounties - Tehran Times
View in full brief →