The National, on Iran, 27 October 2026

6.0out of 10Serious

Handala hacking group

Tap a highlight to see why it matters.2 findings

<a href="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/" target="_blank" rel="" title="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/">Handala,</a> a hacking group that US authorities say is linked to Iran, says it placed bouquets of flowers with "sensitive items" at various polling <a href="https://www.thenationalnews.com/news/mena/2026/10/27/live-israel-election-result-highest-voter-turnout/" target="_blank" rel="" title="https://www.thenationalnews.com/news/mena/2026/10/27/live-israel-election-result-highest-voter-turnout/">sites in Israel</a> as the country votes in one of its most anticipated elections in years.

A message posted to <a href="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/">Handala Hack</a>, the group's Telegram channel, showed pictures and videos of the bouquets appearing just outside voting centres, along with several letters. "Just moments ago, <a href="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/">Handala operatives</a> successfully planted a package containing a bouquet of flowers, a message, and a special letter signed by Asif Sarmad, commander of Handala’s Popular Resistance Front, deep inside the occupied territories, right at the heart of Gadi Eisenkot’s hideout," the Telegram message read.

It was referring to referring to the former military chief of staff seeking to unseat Israeli Prime Minister Benjamin Netanyahu. "The package has now reached the former commander, a clear and mocking message to those who have feared our shadows for years and still entertain illusions of security," the message continued. Handala warned that "in the coming hours", more packages from the hacking group might also be discovered. "Other bouquets have been quietly placed at the heart of your polling stations," read Telegram message.

There was no indication that the bouquets posed any sort of threat. For more than a year, Handala has claimed responsibility for various cyber security-related issues and apparent hacks around the world. In March, the Iran-linked group followed through on a <a href="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/" target="_blank" rel="noreferrer" title="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/">threat to attack</a> the FBI by hacking director Kash Patel's personal email and cloud services.

Hours after making the threat, Handala posted apparent photos of Mr Patel traveling and an old CV with his personal contact information. In a statement at the time, the FBI said it was aware of malicious entities looking to breach Mr Patel's digital assets. "We have taken all necessary steps to mitigate potential risks associated with this activity," the statement read. "The information in question is historical in nature and involves no government information."

The bureau said that the State Department at the time was offering up to a $10 million reward for information leading to the identification of the Handala hackers. for a cyber attack against Michigan-based medical technology <a href="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/">company Stryker</a>, which has more than 50,000 employees around the world.

In March, the US <a href="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/">Justice Department seized</a> websites operated by Handala, but it does not seem to have affected the hacking group's operations. Handala's Telegram channel has been removed several times for breaching the platform's terms of service and other rules, only for the group to re-emerge later with a newly activated account.

Read the original article on thenationalnews.com (opens in a new tab)
What we found (2)

The National reports Handala's claim that it left bouquets and letters at Israeli polling sites, but its headline states that claim as fact. The headline also drops the body's attribution of the group's Iran link to US authorities. In the background section it says 'it was later determined' that Handala attacked Stryker, without naming who made that determination.

  1. Headline goes beyond the article

    Serious

    “Iran-linked”

    Why this matters
    The headline calls Handala "Iran-linked" as a bare fact in the outlet's voice.
    The impression it gives
    A reader takes Handala's link to Iran as established.
    The context
    The body attributes the link to US authorities and gives no other source for it. The headline drops that attribution.

    How we know

    • Elsewhere in the article“a hacking group that US authorities say is linked to Iran”

    Show it in the article

    “sends bouquets and letters to Israel polling sites”

    Why this matters
    The headline states as fact that Handala sent bouquets and letters to polling sites.
    The impression it gives
    A reader believes it is confirmed that the group placed these packages at Israeli polling stations.
    The context
    The body reports only what Handala says it did and what its Telegram channel posted. No independent confirmation appears in the article.

    How we know

    • Elsewhere in the article“says it placed bouquets of flowers”
    • Elsewhere in the article“the group's Telegram channel, showed pictures and videos”

    Show it in the article

    Written straight

    Hacking group Handala, which US authorities link to Iran, says it left bouquets and letters at Israeli polling sites.

  2. States one side's claim as fact

    Minor

    “It was later determined that Handala was responsible”

    Why this matters
    The passive "It was later determined" presents Handala's responsibility for the Stryker attack as settled and names no one who made the determination.
    The impression it gives
    A reader believes an authoritative finding fixed responsibility on Handala.
    The context
    The article names no source for this determination. Elsewhere it attributes such claims to US authorities.

    How we know

    • Elsewhere in the article“US authorities say is linked to Iran”

    Show it in the article

Spot something we missed? Report this article

More from The National

  1. 28 OctIran 'welcomes negotiations' after reported Qatari-mediated draft deal3.0
  2. 28 OctOman calls for economic and security pact between Iran and Gulf countries3.0
  3. 28 OctUAE's Gargash says 'wars only lead to further crises' amid concerns of Iran escalation3.0
  4. 28 OctIran war puts Republican foreign policy hawks under pressure before midterms0.0
  5. 27 OctInside Tehran talks: Iranians link Houthi de-escalation to US approval of regional truce6.0

Everything we scored from The National