Iran-Linked Handala Hackers Deliver 'Bouquets' with 'Sensitive Items' to Israeli Polling Sites

The Handala hacking group, identified by US authorities as being linked to Iran, has claimed responsibility for placing bouquets of flowers containing "sensitive items" at various polling sites across Israel during a highly anticipated election. The group announced this on its Telegram channel, Handala Hack, sharing images and videos of the floral arrangements positioned near voting centers, accompanied by several letters.

One message detailed the operation: "Just moments ago, Handala operatives successfully planted a package containing a bouquet of flowers, a message, and a special letter signed by Asif Sarmad, commander of Handala’s Popular Resistance Front, deep inside the occupied territories, right at the heart of Gadi Eisenkot’s hideout." The group was referring to Gadi Eisenkot, a former military chief of staff who is challenging Israeli Prime Minister Benjamin Netanyahu. The message further stated, "The package has now reached the former commander, a clear and mocking message to those who have feared our shadows for years and still entertain illusions of security." Handala also issued a warning that additional packages from the group might be discovered in the "coming hours." The group reiterated its claim, stating, "Other bouquets have been quietly placed at the heart of your polling stations." There has been no indication that these bouquets pose any threat.

Handala has a history of claiming responsibility for various cybersecurity incidents and apparent hacks globally for over a year. In March, the group targeted FBI Director Kash Patel's personal email and cloud services, posting what appeared to be travel photos and an old CV with his personal contact information. The FBI acknowledged awareness of malicious entities attempting to breach Mr. Patel's digital assets, stating they had taken necessary steps to mitigate risks, and that the information involved was historical and did not include government data.

In March, the US government seized several web assets attributed to the Iran-backed Handala hacking group. The State Department had previously offered a reward of up to $10 million for information leading to the identification of the Handala hackers. Subsequently, Handala was identified as responsible for a cyberattack against the Michigan-based medical technology company Stryker. Despite the US Justice Department seizing Handala-operated websites in March, the group's activities appear to have continued. Handala's Telegram channel has been repeatedly removed for violating the platform's terms of service, only for the group to re-establish its presence with new accounts.