Sophos Reports Surge in Iranian Hacktivist Activity After U.S.-Israeli Strikes
Summary
Sophos CTU reports increased Iranian hacktivist activity after Feb. 28 U.S.-Israeli strikes. Handala and APTIran make unverified intrusion or disruption claims; BaqiyatLock is recruiting affiliates. CTU urges patching, phishing monitoring, reduced exposure and readiness
Key points
- Sophos X-Ops CTU observed increased activity across Telegram, X, and underground forums after the Feb. 28 strikes.
- Handala Hack Team, which the article identifies as a COBALT MYSTIQUE persona, launched the RedWanted hit list on March 1 and claims to have extracted personal information from databases.
- Handala also claims it is sabotaging the oil and gas sector; the article provides no independent confirmation.
- APTIran claims access to Israeli water-control operational technology and says control logic was stopped; the claim is described as unverified.
- BaqiyatLock (BQTlock) is offering free affiliate memberships to attackers targeting Israel.
- CTU recommends prioritizing patches, monitoring for phishing and password spraying, minimizing internet-facing services, and reviewing continuity and restoration plans.
Article Details
- Event Type
- Cyber retaliation and hacktivist activity following U.S. and Israeli military strikes, including website defacement, DDoS, and doxxing.
- Impact
- Sophos X-Ops CTU researchers observed a surge in Iranian hacktivist activity. Handala Hack Team claims large-scale data exfiltration and energy-sector sabotage; APTIran made unverified claims of access to Israeli water-control systems and control interruptions. BaqiyatLock is offering free affiliate memberships for attacks targeting Israel. CTU warns that U.S. organizations may also face retaliatory attacks.
Threat Actors
APTIranShared unverified claims of infiltrating Israeli water-control systems and having access to the operational technology layer.BaqiyatLockDescribed as a ransomware-as-a-service group offering free affiliate memberships to attackers targeting Israel. The article gives BQTlock as an alternate name.BQTlockThe article presents BQTlock as an alternate name for BaqiyatLock, a ransomware-as-a-service group offering free affiliate memberships to attackers targeting Israel.Cobalt MystiqueThe article identifies COBALT MYSTIQUE as the group operating the Handala Hack Team persona, which claims data exfiltration and energy-sector sabotage.Handala Hack TeamA persona that the article says is operated by COBALT MYSTIQUE. It launched the RedWanted hit list and claims data exfiltration and sabotage of Israel's energy sector.
Countries
IsraelBaqiyatLock (BQTlock) RaaS is offering free affiliate memberships to attackers targeting Israel.United StatesSophos XâOps CTU researchers have observed a surge in Iranian hacktivist operations—Operation Epic Fury and Operation Roaring Lion—focused on website defacement, DDoS, and doxxing after coordinated U.S.
Industries
EnergyHack Team (linked to COBALT MYSTIQUE), APTIran, and the BaqiyatLock RaaS are claiming intrusions into energy and water systems and are recruiting affiliates, raising the threat to Israeli and potentially U.S.water(linked to COBALT MYSTIQUE), APTIran, and the BaqiyatLock RaaS are claiming intrusions into energy and water systems and are recruiting affiliates, raising the threat to Israeli and potentially U.S.