Photo: Abx10 / Wikimedia Commons / Public domain
A series of leaflets allegedly linked to threats by the Iran-linked hacktivist Handala group to target Israel’s water and electricity infrastructure were found on Monday in the Tel Aviv area, with the Israel Police and the Shin Bet (Israel Security Agency) announcing that they would open an investigation.
“Not a single power plant, refinery, or desalination plant will remain in the occupied territories. From south to north, your energy and water arteries will shatter like glass,” read part of the message in the leaflets, with the police saying that the circumstances surrounding the distribution of these leaflets are currently under investigation.
According to an initial assessment by the Israel Police, residents of Tel Aviv found the leaflets with a QR code that, when scanned, led to a webpage deemed by the police as “suspected threatening content,” with the message being linked to the Handala group.
In an image shared by the police, the hacktivist group threatens to target Israel’s water desalination plants and energy sites if Israeli leaders “attack the energy infrastructure of the Resistance Front.”
It also warns: “When the shadows of the Resistance decide to act, you will face a world where darkness and thirst will be your only companions, day and night. From now on, you will be forced to spend your lives in the depths of shelters devoid of electricity, water, and hope.”
“The sounds of the commotion in your cities will be silenced forever. This is the final warning. The choice is yours – wisdom, or sinking into the darkness and silence of disaster,” the message concluded.
The police instructed anyone who finds these leaflets in the street to contact authorities and said that an investigation was ongoing.
Israel is world’s most targeted country by cyberattacks
The threats come one month after Microsoft revealed that Israel kept its place as the second most targeted country worldwide by cyberattacks.
According to Microsoft’s 2026 “Digital Defense Report,” published on October 5, Israel is the second-most targeted country in the world, and first in the Middle East, by cyberattacks.
The United States ranked first with 531 observed events, while Israel had 210. Taiwan and Japan followed with 193 and 172, respectively, before a significant drop-off with the United Kingdom in fifth place.
The report also mentioned that Israel experienced a 21% surge in ransomware attacks since 2025.
Israel National Cyber Directorate Chief Yossi Karadi described the situation as Israel being “in an intense campaign in cyberspace and standing at the forefront of global threats.”
“The fact that Israel maintains functional continuity under such a volume of threats is not to be taken for granted. It is the result of an integrated national defense system in which the INCD operates alongside defense bodies, government ministries, the economy, the cyber industry, and global companies,” he added.
He also explained that the cyberspace might have “no missiles in the air, but the fight is waged on a 24/7 basis.”
What is Handala, the Iranian-linked group targeting Israel
The attack by Handala represents a new wave of attacks by the Iranian-linked hacktivist group, which has been one of the main groups targeting Israel since the October 7 massacre in 2023.
The group has ties to Iran’s Intelligence and Security Ministry, according to an assessment by the US Justice Department, even if it portrays itself as an “independent organization.”
Hacktivist groups are organizations that don’t work for a certain state actor’s intelligence operations, but are sometimes sponsored by state actors to perform cyberattacks on enemy nations.
They are usually composed of foreign hackers who identify with certain cause, while the cyberattacks are focused on helping that cause gain traction.
Jonah Davidov and Michael Starr contributed to this report.
