HANDALA

HANDALA is a pro-Palestinian hacktivist group that emerged in late 2023, taking its name from the iconic Palestinian cartoon character Handala created by Naji al-Ali , a symbol of Palestinian resistance and resilience. The group is suspected to have ties to Iranian state intelligence services based on the sophistication of some operations and alignment with known Iranian geopolitical objectives, though this attribution remains contested.

HANDALA gained significant attention for conducting destructive cyber operations against Israeli organisations, including the deployment of wiper malware designed to permanently destroy data on compromised systems rather than encrypting it for ransom. This destructive approach, combined with psychological pressure campaigns, signals a higher operational mandate beyond typical hacktivist financial or notoriety motivations.

The group has claimed responsibility for compromising Israeli water infrastructure systems, radar networks, and government databases , publishing stolen documents and internal communications as evidence. HANDALA has also conducted targeted SMS phishing campaigns against Israeli citizens, sending mass text messages with disturbing content designed to sow panic and undermine public confidence in Israeli security institutions.

HANDALA operates an active Telegram channel with hundreds of thousands of followers, which they use to publish stolen Israeli data, announce operations, and conduct information operations amplifying anti-Israel narratives. Their combination of technical attacks and sophisticated information operations makes them one of the more impactful pro-Palestinian threat actors in the current threat landscape.

Handala operates as a hacktivist leak and disruption brand aligned with Palestinian political messaging. Public cards mix claimed database leaks and website defacements. CyberAsia requires a sample or a unique admin screenshot before upgrading a Handala post from claim to confirmed breach. Do not republish raw PII they dump.

Targets are often poorly patched public sites, not hardened defence networks. WAF, credential hygiene, and a decision not to host donor or member databases on the same CMS as the brochure page will stop most of this class.