Iran-Linked Hackers Say Ceasefire Won’t End Cyberattacks
Summary
Handala said it would continue targeting Israel and may resume attacks on the U.S. U.S. agencies warned that Iran-supporting hackers had accessed internet-connected industrial controllers and urged organizations to update security precautions.
Key points
- Handala said it was temporarily pausing attacks on the U.S. but would continue targeting Israel, and vowed it could resume U.S. operations.
- The FBI, NSA and CISA warned that hackers supporting Iran had accessed internet-connected programmable logic controllers used in sectors including ports, power and water.
- The agencies urged organizations using the controllers to ensure their security precautions were up to date.
- Handala claimed responsibility for hacking Stryker last month; the FBI seized four web addresses the group used to spread its message.
- Handala also claimed it had accessed FBI Director Kash Patel’s personal email account; it later published old photos of Patel.
- A Nozomi Networks executive predicted cyber activity could expand after the ceasefire, but this was a forecast, not a confirmed development.
Article Details
- Event Type
- Iran-linked cyber threat activity and retaliatory attacks continuing amid a temporary ceasefire
- Impact
- Handala said it was temporarily pausing attacks on the U.S. but would continue targeting Israel and later resume efforts against America. The group claimed responsibility for disrupting Stryker and accessing FBI Director Kash Patel’s personal email account; the article does not independently confirm those claims. U.S. authorities also warned that Iran-supporting hackers had accessed internet-connected computers used to control industrial systems, without specifying resulting damage.
People
Kash PatelFBI Director whose personal email account Handala claimed to have hacked; the article does not independently confirm the claim.Markus MuellerCybersecurity executive at Nozomi Networks who said he expected cyber activity against American organizations to expand in scale and scope after the ceasefire.
Threat Actors
Countries
IranHackers backing Tehran say an uncertain ceasefire between Iran and the United States and Israel won’t end their retaliatory cyberattacks, a warning that American cybersecurity experts say potential targets in the U.S.IsraelHackers backing Tehran say an uncertain ceasefire between Iran and the United States and Israel won’t end their retaliatory cyberattacks, a warning that American cybersecurity experts say potential targets in the U.S.KuwaitIran’s missile targeting, and target data centers and industrial facilities in Israel, Saudi Arabia and Kuwait.Saudi Arabiato improve Iran’s missile targeting, and target data centers and industrial facilities in Israel, Saudi Arabia and Kuwait.United StatesHackers backing Tehran say an uncertain ceasefire between Iran and the United States and Israel won’t end their retaliatory cyberattacks, a warning that American cybersecurity experts say potential targets in the U.S.
Industries
Critical infrastructureRelated: Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC AttacksData centersorganizations that participated in the war effort in some way, a list that includes data centers, tech companies and defense contractors.Defenseorganizations that participated in the war effort in some way, a list that includes data centers, tech companies and defense contractors.Technologyauthorities warned on Tuesday that hackers supporting Iran had burrowed into internet-connected computers used to automate and control technology in a variety of important industrial sectors.