Executive Summary
Iran-aligned cyber actors continued operations through October 2026 despite the February ceasefire, with the Handala Hack Team (tracked by Check Point as Void Manticore) extending into hybrid physical-psychological operations against Israeli election infrastructure [1] and sustaining hack-and-leak campaigns against Israeli political figures [2]. Multiple independent sources, including Israel's National Cyber Directorate and major wire services, confirm that the ceasefire has not reduced Iranian cyber tempo; reporting from Halcyon and others indicates a doctrinal shift toward population-scale data collection targeting ISPs, healthcare systems, and telecom providers [3]. Defenders in the DoD, federal healthcare, and critical infrastructure sectors should treat the current period as one of sustained and possibly preparatory threat activity rather than a lull.
What Changed Since September 2026
- Iran-linked Handala hacking group sends bouquets and letters to Israel polling sites
- Handala Claims Hack of Former Israeli Foreign Minister's Data
- Iranian Use of Cybercriminal Tactics in Destructive Cyber Attacks: 2026 Updates
- Justice Department Disrupts Iranian Cyber Enabled Psychological Operations
- Intune Attack: 80,000 Devices Wiped Without Malware | Nagomi
- Stryker attack used Intune to wipe 80,000 devices in three hours, no malware needed
- Stryker Iran-linked attack wiped tens of thousands of devices, reports say
- Stryker attack wipes 200,000 devices and disrupts global healthcare supply chain
- The Stryker Wipe: What 200,000 Lost Devices Teach Us About MDM Blast Radius Protection | Swif
- "Handala Hack" - Unveiling Group's Modus Operandi - Check Point Research
- Israel Says Iranian Cyberattacks Have Tripled — And the Numbers Only Tell Half the Story
- Iran cyberattacks on Israel surged in 2026, Israeli cyber ... - Reuters
- Iran cyberattacks on Israel surged in 2026, Israeli cyber chief says
- global-cyberattacks-continued-despite-ceasefire | perspective | MSSP Alert
- Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long
- How the Iran War Is Redrawing the Cyber Threat Map - RealClearDefense
- Holding Iran accountable for its cyber operations * WorldNetDaily
- Iranian Cyber Operations - RealClearDefense
- Iran–Israel/US Cyber War 2026: Iranian Hackers, APT Groups & Cyber Attacks
Handala Expands into Hybrid Physical-Psychological Operations Against Israeli Elections
- What happened: In late October 2026, the Handala Hack Team claimed it placed bouquets containing unspecified "sensitive items" at Israeli polling locations during a closely watched national election [1]. This operation represents a departure from Handala's established pattern of purely digital destructive wiping and hack-and-leak campaigns [12].
- Cyber implications: The expansion into physical operations timed to democratic events indicates Handala is willing to blend physical intimidation with cyber-enabled influence operations. Organizations responsible for election security should anticipate that Iranian actors may attempt analogous hybrid tactics against other democracies, particularly around politically symbolic dates.
- Sectors at risk: Election infrastructure, public sector, physical security for government facilities
- Confidence: Moderate (single Tier 4 source for the specific claim, but consistent with Handala's documented operational trajectory)
- Sources: [1], [12],
Continued Hack-and-Leak Targeting of Israeli Political Figures
- What happened: Handala claimed responsibility for hacking and publishing approximately 120 documents belonging to Tzipi Livni, a former Israeli foreign minister and deputy prime minister [2]. This follows the group's established pattern of combining data exfiltration with public disclosure for psychological effect [12].
- Cyber implications: High-profile political figures and their staff remain priority targets for credential harvesting and email compromise. The operation is consistent with influence-oriented objectives rather than financial gain, and similar targeting of U.S. political figures or officials with Israel-related portfolios is plausible.
- Sectors at risk: Government, political staff, diplomatic personnel
- Confidence: Moderate (Tier 4 source, but the TTP is consistent with Check Point's documented Void Manticore profile)
- Sources: [2], [12]
Iranian APTs Shift Toward Population-Scale Data Collection
- What happened: Halcyon reporting assesses that multiple Iranian APT groups (APT34, APT35, APT39, APT42) are actively targeting entities holding large individual-level datasets, including ISPs, medical systems, and telecommunications providers [3]. The assessed intent is identifying and locating regime dissidents [3]. Handala's own public blog activity has dropped sharply since January 2026, a pattern Halcyon assesses as consistent with active operational tempo rather than dormancy [3].
- Cyber implications: Any organization holding population-scale PII (patient records, subscriber data, call detail records) is a potential target for Iranian collection operations. The targeting logic is not financial; it is counterintelligence-driven. This means that data theft may not be followed by ransom demands or public leaks, making detection harder.
- Sectors at risk: ISPs, healthcare, telecommunications, diaspora community organizations
- Confidence: Low (Tier 2 recurring source with analytical reasoning, but limited primary evidence cited for the specific APT group list)
- Sources: [3]
MDM Abuse as a Destructive TTP Remains a Validated Threat
- What happened: The March 2026 Stryker attack, in which attackers used Microsoft Intune's native remote wipe functionality to destroy approximately 80,000 devices in three hours [5][6], continued to generate vendor analysis through October. Handala claimed over 200,000 devices were wiped across 79 countries [7][8], but multiple vendors (Guardz, Swif.ai) explicitly flagged a documented pattern of inflated claims for psychological effect [10][11]. The confirmed clinical impact was real: Stryker's Lifenet ECG transmission system became nonfunctional across most of Maryland, forcing EMS to revert to radio consultations [11].
- Cyber implications: The Stryker incident validated MDM platform abuse as a viable destructive technique requiring no malware and bypassing MFA [5]. Defenders managing Intune or equivalent MDM platforms should treat admin account compromise as a worst-case destructive scenario, not merely a data-loss event. The gap between Handala's claimed impact (200,000+ devices, 50TB exfiltrated) and the independently corroborated figure (approximately 80,000 devices) illustrates the importance of not calibrating risk response to unverified threat-actor claims [10][11].
- Sectors at risk: Healthcare, medical device manufacturers, any organization with large MDM-enrolled device fleets
- Confidence: Moderate (multiple corroborating sources on the 80,000-device figure; Tier 1 DOJ attribution [4]; confirmed clinical disruption [11])
- Sources: [4], [5],, [6], [7], [8], [9], [10], [11]
Ceasefire Has Not Reduced Iranian Cyber Operational Tempo
- What happened: Yossi Karadi, Director General of Israel's National Cyber Directorate, stated that Iranian cyberattacks against Israel surged following Operation Epic Fury and continued after the February 2026 ceasefire [13]. The New York Times reported a tactical shift from overt demonstrations toward "quieter efforts to prepare for what might come next". Iran-aligned hacker groups themselves stated publicly that the ceasefire would not end retaliatory operations [16][17].
- Cyber implications: Ceasefire periods should be modeled as continued or heightened risk windows, not periods of reduced threat. The shift toward quieter preparatory operations means defenders may see fewer public claims but should expect sustained reconnaissance, credential harvesting, and pre-positioning activity. MSSP Alert reporting corroborates that global cyberattacks continued unabated despite the ceasefire [15].
- Sectors at risk: Cross-sector, with emphasis on U.S. military, federal government, and critical infrastructure
- Confidence: Moderate (convergence of Tier 1 named-official statements [13], Tier 3 wire-service corroboration, and multiple secondary sources [15][16][17])
- Sources: [13],, [14], [15],, [16], [17]
Strategic Context
- National strategy: Iran's cyber operations function as a persistent instrument of state power below the threshold of armed conflict. The February 2026 ceasefire following Operation Epic Fury did not produce a corresponding cyber stand-down. Available reporting indicates the opposite: Iranian leadership likely views cyber operations as a cost-effective asymmetric tool that can continue regardless of kinetic ceasefire terms [13]. The DOJ's March 2026 domain seizures [4] demonstrate U.S. willingness to impose legal costs, but there is no evidence these actions have materially degraded Iranian cyber capacity.
- Key actors and mandates: Two principal organizations conduct Iranian state-sponsored cyber operations. The Ministry of Intelligence and Security (MOIS) has been formally attributed by the DOJ as the sponsor of the Handala Hack Team's psychological operations and destructive attacks [4]. Separately, the IRGC Cyber Economic Command has been linked to Handala's targeting of U.S. military personnel and defense systems [18][19][20]. Check Point tracks Handala under the designation Void Manticore and characterizes the group as conducting destructive wiping attacks combined with hack-and-leak operations [12]. The dual attribution to both MOIS and IRGC-CEC suggests either shared tasking or that Handala operates at the intersection of both organizations.
- Ongoing strategic objectives: Iran's cyber operations serve three observable objectives: retaliatory signaling against Israel and the United States for Operation Epic Fury [13][18], counterintelligence-driven collection of diaspora and dissident data through population-scale PII targeting [3], and psychological undermining of adversary populations through hack-and-leak operations and, as of October, hybrid physical intimidation [1][2]. The timing of operations to religious and political calendar dates (e.g., Quds Day) indicates deliberate operational planning cycles that defenders can use for predictive monitoring.
Sources: [1], [2], [3], [4], [12], [13],, [18], [19], [20],
Outlook
Three scenario branches are worth monitoring through November and December 2026.
First, the Israeli election results from late October may trigger a new wave of hack-and-leak operations or influence campaigns depending on the outcome. If the elected government takes a harder line on Iran, Handala and associated groups will almost certainly escalate information operations targeting Israeli political figures and institutions [1][2]. Defenders supporting Israeli-linked organizations or dual-national personnel should expect spearphishing campaigns referencing election-related themes.
Second, the approaching anniversary of Operation Epic Fury's initiation (likely early 2027) and any intervening religious calendar dates (Arbaeen, Mawlid al-Nabi) create predictable windows for symbolic operations. Iranian actors have demonstrated a pattern of timing attacks to such dates. Organizations with exposure to Iranian targeting should pre-position hunt teams and increase monitoring density around these windows.
Third, the DOJ domain seizures in March [4] may prompt infrastructure migration. If Handala establishes new claim-and-leak domains, early identification of those domains provides an opportunity for proactive blocking. Conversely, if Handala continues to reduce its public blog presence [3], this likely signals continued operational activity with reduced public attribution, making defender-side detection more important than open-source monitoring of threat-actor communications.
Sources: [1], [2], [3], [4],
Red Sheep Assessment
Assessment (Moderate Confidence): The dual attribution of Handala to both MOIS [4] and IRGC Cyber Economic Command [18][19][20] is underexamined in available reporting. Most sources treat these as interchangeable labels, but the organizational distinction matters. MOIS and IRGC are institutional competitors within the Iranian security apparatus, and a group operating under both would represent either an unusual cross-organizational tasking arrangement or a deliberate blurring of lines to complicate external attribution. One alternative interpretation: the IRGC-CEC attribution appearing in multiple October opinion pieces [18][19][20] with near-identical framing may reflect a coordinated messaging campaign rather than independent intelligence analysis. Defenders should note this attribution as directionally useful but should not treat the IRGC-CEC link as carrying the same evidentiary weight as the DOJ's formal MOIS attribution [4].
A second underappreciated signal: the shift to population-scale PII collection [3] suggests Iranian services are building or augmenting targeting databases that could support future kinetic operations against dissidents abroad, not only cyber operations. The targeting of ISPs, medical systems, and telecom providers is consistent with building a capability to geolocate individuals through correlated datasets (medical appointment locations, cell tower data, IP assignment records). This collection pattern almost certainly has implications beyond the cyber domain.
Defender's Checklist
- ▢[ ] Audit MDM admin accounts: Review all Microsoft Intune (and equivalent MDM) privileged accounts for unnecessary permissions, enforce phishing-resistant MFA (FIDO2), and implement conditional access policies restricting remote wipe commands to specific admin workstations. Reference the Stryker TTP: compromised admin credentials were used to issue factory-reset commands to all enrolled devices [5][9].
- ▢[ ] Implement MDM blast-radius controls: Configure Intune (or equivalent) to require approval workflows for bulk device actions exceeding a defined threshold (e.g., more than 50 simultaneous wipe commands). Test whether your current configuration would allow a single admin to wipe your entire enrolled fleet in one action.
- ▢[ ] Hunt for anomalous bulk PII access: Query SIEM/EDR for unusual export or download volumes from systems containing patient records, subscriber data, or personnel databases. Iranian APTs are targeting ISP, healthcare, and telecom datasets for dissident identification [3]. Baseline normal export volumes and alert on deviations.
- ▢[ ] Pre-position for calendar-based operations: Cross-reference Iranian religious and political calendar dates (Arbaeen, Quds Day, Operation Epic Fury anniversary) with your organization's alert and staffing schedules. Ensure hunt team coverage is not reduced during these windows.
- ▢[ ] Block known Handala infrastructure: Add the four DOJ-seized domains (justicehomeland[.]org, handala-hack[.]to, karmabelow80[.]org, handala-redwanted[.]to) [4] to blocklists if not already present, and monitor DNS logs for resolution attempts to these domains as an indicator of compromised or misconfigured systems still referencing them.
Sources
- [1] "Iran-linked Handala hacking group sends bouquets and letters to Israel polling sites" - The National News, https://www.thenationalnews.com/future/technology/2026/10/27/handala-israel-election-bouquets/
- [2] "Handala Claims Hack of Former Israeli Foreign Minister's Data" - Wanaen, https://wanaen.com/handala-claims-hack-of-former-israeli-foreign-ministers-data/
- [3] "Iranian Use of Cybercriminal Tactics in Destructive Cyber Attacks: 2026 Updates" - Halcyon, https://www.halcyon.ai/ransomware-alerts/iranian-use-of-cybercriminal-tactics-in-destructive-cyber-attacks-2026-updates
- [4] "Justice Department Disrupts Iranian Cyber Enabled Psychological Operations" - U.S. Department of Justice, https://www.justice.gov/opa/pr/justice-department-disrupts-iranian-cyber-enabled-psychological-operations
- [5] "Intune Attack: 80,000 Devices Wiped Without Malware" - Nagomi Security, https://nagomisecurity.com/no-malware-no-zero-day-80000-devices-wiped
- [6] "Stryker Iran-linked attack wiped tens of thousands of devices, reports say" - Paubox, https://www.paubox.com/blog/stryker-iran-linked-attack-wiped-tens-of-thousands-of-devices-reports-say
- [7] "Stryker Cyberattack: Handala Iran Hack Wiped 200K Devices" - Tech Insider, https://tech-insider.org/stryker-cyberattack-handala-iran-mdm-wipe-2026/
- [8] "Stryker attack wipes 200,000 devices and disrupts global healthcare supply chain" - Triskele Labs, https://www.triskelelabs.com/resources/stryker-mdm-attack-device-wipe-healthcare-supply-chain
- [9] "The Stryker Hack: How One Compromised Admin Account Led to 200,000 Wiped Devices" - Lumos, https://www.lumos.com/blog/stryker-hack
- [10] "The Stryker Wipe: What 200,000 Lost Devices Teach Us About MDM Blast Radius Protection" - Swif.ai, https://www.swif.ai/blog/stryker-wipe-lessons-about-mdm-blast-radius-protection
- [11] "The Stryker Story: When Device Management Platform Becomes a Weapon" - Guardz, https://guardz.com/blog/the-stryker-story-when-device-management-platform-becomes-a-weapon/
- [12] "Handala Hack: Unveiling Group's Modus Operandi" - Check Point Research, https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/
- [13] "Israel Says Iranian Cyberattacks Have Tripled" - CyberDelegate, https://www.cyberdelegate.com/israel-says-iranian-cyberattacks-have-tripled-and-the-numbers-only-tell-half-the-story/
- [14] "Iran cyberattacks on Israel surged in 2026, Israeli cyber chief says" - Rappler, https://www.rappler.com/technology/iran-cyberattacks-israel-surged-2026-yossi-karadi/
- [15] "A Ceasefire Didn't Stop the Cyber Threat" - MSSP Alert, https://www.msspalert.com/perspective/a-ceasefire-didnt-stop-the-cyber-threat
- [16] "Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long" - The Reporter, https://www.thereporteronline.com/2026/04/08/iran-us-cyberthreats/
- [17] "Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long" - Los Angeles Times, https://www.latimes.com/world-nation/story/2026-04-09/shaky-ceasefire-unlikely-to-stop-cyberattacks-from-iran-linked-hackers-for-long
- [18] "How the Iran War Is Redrawing the Cyber Threat Map" - RealClearDefense, https://www.realcleardefense.com/cyber-warfare/links/how-the-iran-war-is-redrawing-the-cyber-threat-map-2026-10-26
- [19] "Holding Iran accountable for its cyber operations" - WorldNetDaily, https://www.wnd.com/2026/10/holding-iran-accountable-its-cyber-operations/
- [20] "Iranian Cyber Operations" - RealClearDefense, https://www.realcleardefense.com/cyber-warfare/articles/iranian-cyber-operations-2026-10-17