Handala ransomware group lists $50M Reward For Trump & Netanyahu on its leak site

• Ransomware group: Handala
• Announcement date: March 25, 2026

Handala issues bounty announcement targeting political figures

The group known as Handala has published a bounty announcement targeting specific political figures. On March 24, 2026, the group issued a statement calling for actions against certain political leaders, claiming to offer a 50 million dollar reward for such actions. This announcement was subsequently posted on a leak site on March 25, 2026.

Details of the group's claims

The announcement made by Handala focuses on political mobilization rather than technical exploitation. According to the group's post, they are offering a significant financial incentive to encourage actions against the named individuals. The group's communication strategy involves the use of encrypted messaging applications, and the post explicitly invites followers to collaborate through these specific digital channels.

In the context of cyber threat intelligence, it is important to distinguish between traditional cybercrime and politically motivated rhetoric. While many ransomware groups operate under a model of financial extortion—often employing double extortion tactics where data is both encrypted and stolen to increase leverage—the claims made by Handala appear to deviate from this standard operational procedure. Instead of focusing on the theft of corporate secrets or sensitive databases, the group's messaging is centered on political propaganda and the solicitation of physical or targeted actions.

Data and technical details

The announcement does not mention any data breach or technical compromise. The content consists entirely of politically motivated bounty claims and propaganda messages. No specific information was provided regarding the amount of data stolen, the number of files involved, or any specific technical vulnerabilities exploited during the alleged event.

• No data types were named in the listing.

Assessment and implications

This announcement by the Handala group may be characterized as a politically motivated threat and propaganda effort rather than traditional ransomware activity. Such rhetoric could indicate the group's attempt to mobilize its target audience through digital platforms. The content of the post may heighten concerns regarding physical security and could be monitored closely by international security authorities.

Given the group's alleged ties to Iran and its history of Israel-focused activities, it is possible that such actions may carry the potential to escalate regional tensions within the digital domain. When groups shift from digital extortion to calls for physical action, the threat landscape evolves from a purely cybersecurity concern to a broader security and geopolitical issue.

General defensive considerations

While this specific incident is characterized by propaganda rather than a data breach, organizations and authorities often face similar challenges when dealing with politically motivated actors. In traditional ransomware scenarios, organizations typically focus on robust backup strategies, network segmentation, and comprehensive endpoint detection and response (EDR) to mitigate risks. However, when threats move into the realm of political propaganda and calls for physical action, the focus shifts toward monitoring digital platforms for mobilization efforts and coordinating with law enforcement and international security agencies to address potential physical security risks. Monitoring for extremist rhetoric and maintaining high situational awareness regarding geopolitical tensions are essential components of a comprehensive security posture in such environments.