Handala ransomware group lists Caught by the Octopus: Bennett’s Darkest Hour on its leak site

• Ransomware group: Handala
• Announcement date: December 17, 2025

Handala claims to have accessed confidential data belonging to Naftali Bennett

The threat actor known as Handala has published a data leak announcement on its platform, alleging that it has successfully targeted Naftali Bennett. The announcement, which was made public on December 17, 2025, serves as a claim of a successful breach involving sensitive information. While the group has officially announced this event, the claims remain unverified by external parties.

In the landscape of modern cyber threats, ransomware groups and hacktivist collectives often utilize leak sites to exert pressure on their targets. These sites are frequently used in double extortion schemes, where attackers not only encrypt an organization's data but also threaten to release it publicly to increase the likelihood of a payout or to achieve political objectives. Such tactics are designed to maximize reputational damage and psychological pressure on the intended victims.

The group claims a long-term surveillance operation

According to the announcement released by Handala, the group asserts that it has been conducting surveillance for a period of two years. The group claims that during this extended timeframe, it has been able to archive various communications and files. This claim suggests a persistent and methodical approach to the operation rather than a sudden, opportunistic intrusion.

The timing of the announcement appears to be significant, as the group has linked this message to its second anniversary. This suggests that the disclosure is intended to serve as a threatening message to the target, marking the group's milestone through a high-profile claim of successful espionage or data theft.

Details regarding the allegedly leaked data

The group has not provided specific details regarding the nature of the data they claim to have stolen. The announcement refers generally to the acquisition of confidential communications and files. No specific file types, data volumes, or specific categories of information were identified in the claim.

Assessment of the threat actor and potential risks

The Handala group is assessed to have links to Iran and is known for conducting politically motivated attacks that target Israel. Because of this profile, the group's activities are often characterized by political motivations rather than purely financial ones. The group has a history of employing destructive attack methods and data disclosure techniques, which indicates that the allegedly leaked information could pose significant secondary risks to the target.

The potential impact of such a leak is multifaceted. For an individual, the disclosure of confidential communications could lead to severe reputational damage and pose direct personal security risks. Furthermore, unless the content of the data is independently verified, the possibility that this situation is part of a disinformation campaign should not be overlooked. In the realm of cyber warfare and political hacktivism, the release of fabricated or manipulated data can be just as damaging as the release of genuine sensitive information.

Defensive considerations for high-profile targets

When dealing with politically motivated actors who utilize data disclosure as a weapon, organizations and individuals must prioritize comprehensive security frameworks. Defensive strategies typically involve robust monitoring to detect long-term unauthorized presence, as the Handala group claims to have maintained access for two years. Implementing strict access controls and encryption for all sensitive communications is a fundamental step in mitigating the impact of potential data theft.

Furthermore, because these groups may engage in disinformation, it is essential for entities to have established communication protocols to manage public perception and verify the authenticity of any leaked materials. Organizations should focus on identity and access management to prevent unauthorized lateral movement, which is often necessary for the long-term surveillance described in such claims. Maintaining a strong incident response plan that accounts for both technical remediation and reputational management is critical in the face of high-stakes data disclosure threats.