Handala claims cyberattack against Israel Ministry of National Security

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: January 29, 2025

The Handala group has announced a cyberattack targeting the Israel Ministry of National Security. According to an announcement posted on a leak site on January 29, 2025, the group claims to have successfully breached the organization's systems, asserting that the attack has caused significant disruption.

The details of the claim

The Handala group asserts that they have breached the comprehensive integrated management system used for the regime's shelters. Beyond merely accessing the network, the group claims to be actively wiping systems and causing direct disruption to shelter management operations. This claim was officially posted on January 29, 2025, and coincides with the date the group identifies as the attack date.

In the context of modern cyber threats, such claims often involve double extortion tactics. In these scenarios, threat actors do not only encrypt or disrupt operational systems to halt business or government functions, but they also steal sensitive data to use as leverage. By threatening to leak stolen information, attackers aim to increase the pressure on the victim to meet their demands. While the specific mechanics of this particular incident remain under investigation, the disruption of management systems is a hallmark of high-impact cyber operations.

Data and evidence provided

Regarding the information allegedly stolen during the breach, the group has provided some visual evidence. Screenshots released by the group show data tables and a hardware device. However, the specific nature of the leaked data has not been explicitly listed in the group's text. No specific file counts, data sizes, or specific categories of sensitive information have been provided by the group at this time.

The listing names no specific data types.

The Israel Ministry of National Security

The Israel Ministry of National Security is the government body responsible for Israel's internal security, police forces, and public order. The ministry is tasked with setting national security policies and overseeing law enforcement agencies. Given its role in overseeing law enforcement and maintaining public order, the ministry manages critical infrastructure essential to the stability and safety of the state.

Implications and defensive considerations

This claim may indicate a cyberattack targeting critical public infrastructure. Such an incident could potentially lead to national security risks and disruption of public order. If data is leaked, sensitive information regarding critical infrastructure management may be exposed. Given the group is assessed to be Iran-linked, this could escalate geopolitical tensions. The severity of this incident may be considered high due to the critical nature of the targeted government institution.

For organizations operating within the government and defense sector, maintaining the integrity of critical infrastructure is paramount. To defend against such high-stakes threats, organizations typically implement several defensive layers. This includes robust network segmentation to prevent lateral movement, strict access controls to limit the scope of a potential breach, and continuous monitoring to detect anomalous behavior within management systems. Furthermore, maintaining offline, immutable backups is a standard practice to mitigate the impact of system-wiping attacks. As geopolitical tensions can influence the threat landscape, government entities must remain vigilant against sophisticated actors targeting public order and safety systems.