TEHRAN -- Handala hacker group claims to have distributed hundreds of thousands of threatening leaflets across Tel Aviv, warning that power plants, oil refineries and desalination facilities could be targeted in retaliation for further attacks on Iran's energy infrastructure.
The self-described pro-Iranian hacking group Handala has taken its latest warning against the Israeli regime beyond cyberspace, claiming to have distributed hundreds of thousands of threatening leaflets in residential neighborhoods across Tel Aviv overnight.
In a statement published on Monday, the group said dozens of its operatives had moved through residential areas under the cover of darkness, placing warning notices in mailboxes and outside residents' homes. The campaign, according to Handala, was intended to deliver a direct message to the Israeli public: any further attack on Iran's energy infrastructure could have consequences extending far beyond the battlefield and into the daily lives of Israelis.
The leaflets, bearing the slogans "No Water" and "No Electricity," reportedly direct residents to the group's official website, where a message described as a final warning has been published.
"If your leaders once again succumb to their foolishness and target the energy infrastructure of the Resistance Front, you must be prepared to pay a heavy price for this aggression not on the battlefield, but in your everyday lives," the message reads.
Handala's warning specifically identifies power plants, oil refineries and desalination facilities across the occupied territories as potential targets.
"Not a single power plant, oil refinery or desalination facility in the occupied territories will remain, from north to south," the statement declares, threatening that the energy and water supply networks would collapse.
The message goes on to warn that Israelis could find themselves spending their days and nights in darkness and thirst, eventually being forced to seek shelter in facilities without electricity, water or hope.
"This is the final warning. The choice is yours: rationality, or a descent into catastrophic darkness and blackout," the group says.
Alongside its statement, Handala published photographs purportedly showing mailboxes filled with the leaflets, as well as a video carrying the message: "Tel Aviv, are you ready?"
A message delivered to residents' doorsteps
The campaign appears to have extended well beyond the digital sphere. Dozens of photographs circulated by Handala show residential mailboxes across Tel Aviv containing copies of the warning leaflets, providing visual evidence that the distribution operation took place in multiple locations.
The group has claimed that hundreds of thousands of copies were distributed, although the precise number has not been independently established.
The photographs, alongside a video carrying the message "Tel Aviv, are you ready?", suggest an effort to bring the group's warning directly into residential neighborhoods and make the prospect of infrastructure disruption a tangible concern for ordinary residents.
The physical distribution of the leaflets is significant because it takes the group's messaging beyond online platforms and places it directly in the everyday environment of the population being addressed.
However, the leaflet campaign should not be viewed in isolation from the cyber operations already targeting Israeli infrastructure and public services. Previous incidents attributed to Handala have demonstrated that hackers can penetrate systems connected to essential services and exploit them to produce real-world effects. In one reported case, the group breached a company s systems linked to public-address infrastructure and used them to broadcast sirens and messages; another incident involved the unauthorized transmission of threatening messages through a regional council s systems. Such cases underscore the vulnerability of digitally connected infrastructure and the potential consequences of a coordinated cyberattack. While there is no publicly verified evidence that Handala has gained operational control of power grids, water distribution networks or desalination facilities, the record of intrusions into related systems makes the threat of a wider attack more than a purely hypothetical scenario.
The campaign represents an attempt to bring the group's psychological and cyberwarfare messaging directly into the residential environment, addressing ordinary Israelis rather than limiting its communications to government institutions, military establishments or corporate targets.
Its central message is that the consequences of another attack on Iranian infrastructure could be felt in the most basic elements of everyday civilian life: electricity, drinking water and access to essential services.
The emphasis on desalination facilities is particularly significant. Desalination plays a major role in supplying drinking water across the occupied territories, making such facilities strategically important to civilian infrastructure.
By explicitly naming power stations, refineries and desalination plants, Handala is seeking to underline the vulnerability of interconnected infrastructure systems and the potential consequences of a wider confrontation.
The campaign also reflects the growing prominence of cyber operations and psychological warfare in the confrontation between Iran and the Israeli regime. Threats involving critical infrastructure are no longer confined to technical warnings exchanged between cybersecurity institutions.
They have increasingly become part of public messaging intended to influence perceptions of security and the potential costs of military escalation.
The campaign carries a message that goes beyond the immediate claims of the hackers: in a confrontation involving highly interconnected strategic infrastructure, the potential consequences of escalation may not remain confined to military installations.
By placing its warning in residential mailboxes across Tel Aviv, Handala is attempting to bring that possibility directly to the public's doorstep.