Netanyahu’s cabinet targeted by Handala group in alleged cyber operation

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: December 27, 2025

Handala group claims operations against Netanyahu cabinet

The cyber threat landscape has seen a new development involving the Netanyahu cabinet, which was targeted by the group known as Handala. In an announcement published on December 27, 2025, the group claimed to have successfully executed the first phase of their cyber operations against the Israeli government entity.

According to the claims made by Handala, the group has shifted its strategic focus following feedback received from its followers. This shift specifically concerns the release of data related to certain individuals. The group has issued a deadline, stating that the cabinet will discover the full extent of the group's presence and reach on December 28, 2025, at 07:30 AM GMT+2.

Details of the alleged data breach

In the announcement released by Handala, the group did not provide any concrete data files to support their claims. The text of the announcement implies that information regarding specific individuals is intended to be leaked in the future. The accompanying imagery used in the announcement consisted of stock images depicting security cameras and individuals working at computer terminals.

The listing names no specific data types that have been compromised.

Context of ransomware and leak site activities

In modern cyber warfare, groups often utilize leak sites to host announcements regarding their activities. These platforms are frequently used in double extortion tactics, where attackers not only encrypt an organization's data but also threaten to release sensitive information to pressure the victim. This method is designed to maximize leverage by targeting the reputation and operational integrity of the victim organization through the exposure of private information.

Implications of the Handala announcement

The announcement by Handala may be intended to exert psychological pressure on the Israeli government. Given that the group is assessed to have links to Iran, such actions may potentially be part of state-sponsored cyber espionage activities. The potential release of sensitive data belonging to public officials could increase individual security risks and lead to targeted phishing attacks against those individuals.

Considering the group's history of claims regarding destructive attacks, secondary risks to the institution's digital infrastructure may persist. Such threats often necessitate a thorough review of national security protocols to mitigate the impact of potential leaks or further intrusions.

Defensive considerations for government sectors

Organizations within the government and defense sectors face unique challenges when dealing with high-profile threat actors. When facing potential state-sponsored espionage or psychological operations, maintaining robust monitoring and rapid response capabilities is essential. Defensive strategies typically involve a multi-layered approach to security, focusing on identity and access management, continuous network monitoring, and rigorous incident response planning to address the risks of both data exfiltration and infrastructure disruption.