Before Ceasefire Handala Boasts of Israeli Shelter Location Access

• A cybercriminal group named Handala claims to possess Israel’s complete list of shelter locations
• They allegedly have exact locations of these shelters as posted in a message on the dark web
• The message, aimed at pressuring Israeli authorities, emerged as reports of a ceasefire began to surface

The cyberwarfare between Israel and Iran has taken a new turn with a group leaving a note directly addressed to Sara Netanyahu. The latest threat intelligence comes from Handala, the cybercriminal group that claims to have gained access to the full list of ‘shelter locations’ across Israel.

In a message posted on June 23, 2025, the group asserted that they obtained the exact coordinates of shelters where key figures in Israel are situated. 

To exert pressure on the Israeli authorities, they addressed the message to Sara Netanyahu, an educational psychologist and Benjamin Netanyahu's wife. It read, “The list of Israeli shelters has been exposed. Every location is now known.”

They further warned the people of Israel to evacuate, emphasizing that this was ‘the truth’ and ‘not a threat.’ This psychological warfare aimed to sow fear and vulnerability by claiming shelters are compromised by exposed data, thereby undermining public confidence and pressuring leadership. 

It is not clear how the threat actors gained access to the highly protected shelter locations in Israel, which are presumably bomb shelters and protective bunkers designed for civilians and emergency purposes. 

However, the conflict extends beyond cyberwarfare and online threats. With Operation Rising Lion, Israel targeted Iranian nuclear facilities, military bases, and strategic sites. Following this, Iran retaliated with missile and drone attacks on Israel and launched missiles at the U.S. military's Al Udeid Air Base in Qatar.

The U.S. State Department announced a reward of up to $10 million for information leading to the identification or location of Iran’s IRGC hackers, specifically the CyberAv3ngers group. 

This group is associated with ‘Mr. Soul,’ who has targeted the U.S. critical infrastructure.

In response to the escalating situation, the DHS issued a national terrorism advisory system bulletin addressing the increasing cyber threats arising from the Israel-Iran conflict. It noted that US infrastructure would suffer cyberattacks due to the nation’s involvement in both the online and offline aspects of the Israel-Iran conflict. 

Secretary of Homeland Security Kristi Noem stated, “The ongoing Israel-Iran conflict brings the possibility of increased threat to the homeland in the form of possible cyberattacks, acts of violence, and antisemitic hate crimes.”

On the other hand, tensions may de-escalate, as Israel has reportedly agreed to a ceasefire, a development announced by Donald Trump on Truth Social.