Israeli authorities have launched an investigation into a series of leaflets discovered in the Tel Aviv area on Monday. The documents, which contain threatening messages regarding the nation's energy and water supplies, are alleged to be linked to the Handala group, a hacktivist collective with ties to Iran. Both the Israel Police and the Shin Bet, the Israel Security Agency, have confirmed that they are examining the circumstances surrounding the distribution of these materials.
The leaflets feature a stark warning aimed at the country's critical infrastructure. One section of the message reads that no power plant, refinery, or desalination plant will remain untouched in the occupied territories. The text further claims that energy and water arteries from south to north will shatter like glass. Police officials stated that the method and timing of the leaflets' distribution are currently under scrutiny.
Residents of Tel Aviv reportedly found the physical leaflets, which included a QR code. When scanned, this code directed users to a webpage containing what police described as suspected threatening content. The online message was attributed to the Handala group, reinforcing the connection between the physical distribution and the digital campaign.
In an image released by the police, the group threatened to target desalination plants and energy sites if Israeli leaders attack the energy infrastructure of the Resistance Front. The message warned that when the shadows of the Resistance decide to act, the population would face a world of darkness and thirst. It suggested that citizens would be forced to live in shelters devoid of electricity, water, and hope, with the sounds of commotion in their cities silenced forever.
The message concluded by describing the situation as a final warning, stating that the choice was between wisdom or sinking into the darkness and silence of disaster. In response to the discovery, police instructed the public to contact authorities if they find similar leaflets in the street. An ongoing investigation aims to determine the full scope of the operation and the identities of those responsible.
These threats arrive at a time when Israel faces significant cyber pressure. One month prior, Microsoft published its 2026 Digital Defense Report, which placed Israel as the second most targeted country in the world by cyberattacks. The United States ranked first with 531 observed events, while Israel recorded 210. Taiwan and Japan followed with 193 and 172 events respectively, marking a significant drop before the United Kingdom appeared in fifth place.
The report also highlighted a 21% surge in ransomware attacks against Israel since 2025. Yossi Karadi, the Chief of the Israel National Cyber Directorate, described the current environment as an intense campaign in cyberspace where Israel stands at the forefront of global threats. He noted that while there may be no missiles in the air, the fight is waged on a 24/7 basis.
Karadi emphasized that maintaining functional continuity under such a high volume of threats is a result of an integrated national defense system. This system involves the INCD operating alongside defense bodies, government ministries, the economy, the cyber industry, and global companies. He stated that this level of resilience should not be taken for granted.
The Handala group has been one of the primary actors targeting Israel since the October 7 massacre in 2023. According to an assessment by the US Justice Department, the group has ties to Iran's Intelligence and Security Ministry, despite portraying itself as an independent organization. This recent wave of leaflets represents a new tactic in their ongoing campaign.
Hacktivist groups like Handala typically consist of foreign hackers who identify with a specific cause. While they do not always work directly for state intelligence operations, they are sometimes sponsored by state actors to perform cyberattacks on enemy nations. The focus of these attacks is generally to help the chosen cause gain traction on the global stage.
