The National, on Iran, 27 October 2026

3.0out of 10Minor

Handala hacking group

Tap a highlight to see why it matters.2 findings

<a href="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/" target="_blank" rel="" title="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/">Handala,</a> a hacking group that US authorities say is linked to Iran, says it placed bouquets of flowers with "sensitive items" at various polling <a href="https://www.thenationalnews.com/news/mena/2026/10/27/live-israel-election-result-highest-voter-turnout/" target="_blank" rel="" title="https://www.thenationalnews.com/news/mena/2026/10/27/live-israel-election-result-highest-voter-turnout/">sites in Israel</a> as the country votes in one of its most anticipated elections in years.

A message posted to <a href="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/">Handala Hack</a>, the group's Telegram channel, showed pictures and videos of the bouquets appearing just outside voting centres, along with several letters. "Just moments ago, <a href="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/">Handala operatives</a> successfully planted a package containing a bouquet of flowers, a message, and a special letter signed by Asif Sarmad, commander of Handala’s Popular Resistance Front, deep inside the occupied territories, right at the heart of Gadi Eisenkot’s hideout," the Telegram message read.

It was referring to referring to the former military chief of staff seeking to unseat Israeli Prime Minister Benjamin Netanyahu. "The package has now reached the former commander, a clear and mocking message to those who have feared our shadows for years and still entertain illusions of security," the message continued. Handala warned that "in the coming hours", more packages from the hacking group might also be discovered. "Other bouquets have been quietly placed at the heart of your polling stations," read Telegram message.

There was no indication that the bouquets posed any sort of threat. For more than a year, Handala has claimed responsibility for various cyber security-related issues and apparent hacks around the world. In March, followed through on a <a href="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/" target="_blank" rel="noreferrer" title="https://www.thenationalnews.com/future/2026/03/27/iran-hack-fbi-kash-patel-handala/">threat to attack</a> the FBI by hacking director Kash Patel's personal email and cloud services.

Hours after making the threat, Handala posted apparent photos of Mr Patel traveling and an old CV with his personal contact information. In a statement at the time, the FBI said it was aware of malicious entities looking to breach Mr Patel's digital assets. "We have taken all necessary steps to mitigate potential risks associated with this activity," the statement read. "The information in question is historical in nature and involves no government information."

The bureau said that the State Department at the time was offering up to a $10 million reward for information leading to the identification of the Handala hackers. against Michigan-based medical technology <a href="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/09/08/iran-cyber-attacks-us-fbi/">company Stryker</a>, which has more than 50,000 employees around the world.

In March, the US <a href="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/" target="_blank" rel="" title="https://www.thenationalnews.com/future/technology/2026/03/20/iran-hackers-handala-fbi-doj-seizure/">Justice Department seized</a> websites operated by Handala, but it does not seem to have affected the hacking group's operations. Handala's Telegram channel has been removed several times for breaching the platform's terms of service and other rules, only for the group to re-emerge later with a newly activated account.

Read the original article on thenationalnews.com (opens in a new tab)
What we found (2)

The National reports that the hacking group Handala says it left bouquets and letters at Israeli polling sites, and it adds that there was no sign of any threat. The headline drops two attributions the body gives: that the Iran link is what US authorities say, and that the bouquet drop is what Handala says it did. The article also states that Handala was behind the Stryker attack without saying who found this.

  1. Headline goes beyond the article

    Minor

    “Iran-linked”

    Why this matters
    The headline calls Handala "Iran-linked" in the outlet's own voice.
    The impression it gives
    The reader takes Handala's link to Iran as an established fact.
    The context
    The body gives the link as the view of US authorities, not as a fact The National has shown.

    How we know

    • Elsewhere in the article“a hacking group that US authorities say is linked to Iran”

    Show it in the article

    “sends bouquets and letters to Israel polling sites”

    Why this matters
    The headline states as fact that Handala sent bouquets and letters to polling sites.
    The impression it gives
    The reader takes the delivery as confirmed.
    The context
    The body reports only that Handala says it placed the bouquets and that its own Telegram channel posted the pictures. Nothing in the article confirms the drop independently.

    How we know

    • Elsewhere in the article“says it placed bouquets of flowers”
    • Elsewhere in the article“the group's Telegram channel, showed pictures and videos”

    Show it in the article

    “the Iran-linked group”

    Why this matters
    The body repeats "Iran-linked" in the outlet's own voice, nine sentences after attributing the link to US authorities.
    The impression it gives
    The reader treats the Iran link as settled background.
    The context
    The only source for the link the article gives is US authorities.

    How we know

    • Elsewhere in the article“US authorities say is linked to Iran”

    Show it in the article

  2. States one side's claim as fact

    Minor

    “It was later determined that Handala was responsible for a cyber attack”

    Why this matters
    The passive "It was later determined" states Handala's responsibility for the Stryker attack as fact and names no one who determined it.
    The impression it gives
    The reader takes it as officially established that Handala carried out the Stryker attack.
    The context
    The article gives no source for this finding: no agency, company statement or investigator. Elsewhere it notes that Handala claims responsibility for many incidents.

    How we know

    • Elsewhere in the article“Handala has claimed responsibility for various cyber security-related issues”

    Show it in the article

What it gets right

  • “There was no indication that the bouquets posed any sort of threat.”

    The outlet sets a plain factual check against the group's menacing Telegram messages, so the threat claims do not stand unchallenged.

  • “says it placed bouquets of flowers”

    The body attributes the bouquet drop to Handala's own claim rather than stating it as fact.

Spot something we missed? Report this article

More from The National

  1. 27 OctInside Tehran talks: Iranians link Houthi de-escalation to US approval of regional truce6.0
  2. 26 OctIraqi court seeks arrest of Maysan provincial leader for defying Iran border closure6.0
  3. 26 OctSaudi Defence Minister leads Makkah pact delegation to Tehran3.0
  4. 25 OctUAE officials reject Iran's criticism of UN candidate Nusseibeh 3.0
  5. 25 OctThe Gulf’s unfinished defence infrastructure0.0

Everything we scored from The National