Tuesday, December 16, 2025

'The hunt has begun': Iran-linked hackers put bounties for info on Israeli air defense developers - Michael Starr, Mathilda Heller

 

by Michael Starr, Mathilda Heller

The release of information is part of a broader series of bounties, threats, and doxing.

 

Laptop and source code on the screen composing flag of Iran.
Laptop and source code on the screen composing flag of Iran.
(photo credit: max.ku/Shutterstock)

 

An Iran-linked hacker group has put a bounty for information on over a dozen Israelis it claims are developers of Patriot, Arrow, and David's Sling air defense systems, as part of a continued project threatening and doxing Israeli academics, journalists, and defense personnel.

The Handala hacker group on Saturday offered a $30,000 bounty on information on Israeli engineers and technicians, listing their photos, names, credentials, email addresses, locations, and phone numbers. The Jerusalem Post is yet to verify if all the doxxed information is correct. However, it has been spread widely on Arab media and Telegram, including by Hamas.

The profiles on the Israelis often included personal messages, with one target being warned that his children would not be safe.

"You thought your family - the wife - three children - were safe," the hacker group wrote on its target database website. "Don't forget about those three children.”

Others were told that they had become "marked" and that their emails and phone numbers were being monitored.

 An illustration of a cyber hacker and the Iranian flag. (credit: PX Media/Shutterstock)
An illustration of a cyber hacker and the Iranian flag. (credit: PX Media/Shutterstock)
"To the engineers and collaborators of the occupation: Your regime cannot shield you," wrote the hacker group on its blog. "Your anonymity is a fantasy, your safety an illusion. From this moment forward, you are being watched. Fear is no longer an option, t[his] is your new reality."

The release of information is part of a broader series of bounties, threats, and doxing. Since October 18, the group has published a list of Israelis on Saturdays, claiming that they were integral to Israeli weapons programs.

The announcement of the "RedWanted" campaign warned that "from this moment forward, none of them can walk freely, neither in their laboratories nor in their homes. The world now knows who you are and what you have done. Our friends and supporters are closer than you imagine."

Other Israelis on the near weekly lists were introduced as "corpses," such as with a list of alleged IDF unit 8200 soldiers. A $10,000 award was offered for information regarding their whereabouts or activities.

Another set of bounties, describing Israelis as "wanted," offered $10,000 for information that would lead to their "apprehension."

The database of almost 200 Israelis contains personalized, rambling, threatening messages for each person, with a crosshair that appears on their picture when the cursor hovers over it.

"Israel must now await a harsh punishment," a banner at the top of the website threatened.

In an explanation for the database, the hackers said, "Your crimes will not be forgotten, your deeds will not go unanswered. Handala RedWanted is watching, remembering, and acting. The hunt has begun, and it will not end until justice is served."

The group posted a video, in which targets were listed as "killed by Handala" alongside what appeared to be bomb making materials.

The Jerusalem Post has reached out to the individuals listed on the most recent target list. It also reached out to the Defense Ministry for comment.

Previous activities

Handala has been extensively linked to Iran’s intelligence services. The Jerusalem Institute for Strategy and Security said it has been used by Iran since late 2023.

It has carried out hostile activity on Israeli targets for around two years. In January 2025, it launched a cyberattack on kindergartens in Israel, disrupting public address (PA) systems across 20 locations.

On August 22, 2025, it hacked multiple Israeli entities, including the Weizmann Institute, Kibbutz Almog, AeroDreams, YG New Era, communications firm 099, TBN News, Agora, Saban Systems, Al-Wahar Automotive Services, YHD Group, Ben Hurin & Alexandrovitz, and Job Info. 

In September 2025, the Canadian government's Rapid Response Mechanism (RRM Canada) reported that it had detected a “hack and leak” operation by Handala targeting five Iran International journalists, including one from Canada. RRM Canada assesses that the operation began on July 8, 2025.

The hacked materials ranged from photos of government IDs to intimate content, and were released via the Handala website in a similar manner as with the Israeli engineers.

RRM Canada also detected amplification of the leaked information via multiple AI chatbots, including ChatGPT, Gemini, Copilot, Claude, Grok, and DeepSeek. 


Michael Starr, Mathilda Heller

Source: https://www.jpost.com/israel-news/defense-news/article-880394

Follow Middle East and Terrorism on Twitter

No comments:

Post a Comment