An Iran-linked hacker group said it was offering a $30,000 reward for information related to Israel’s military sector after releasing material it said identified people involved in designing Israeli missile defense systems.
The group, known as Handala, said it had released information on 13 individuals it described as key designers of systems such as Arrow and David’s Sling.
The material published by the group included photos, names, professional credentials, email addresses, locations and phone numbers.
“These individuals, who were once thought to be hidden in the shadows, are now fully exposed to the world,” the group said in a statement carried by Iran’s ISNA news agency, adding that it would pay $30,000 for what it called valuable information.
Israeli media outlets, including the Jerusalem Post, have not confirmed whether the information released by the group is accurate.
Who is Handala?
Handala is widely described by cybersecurity researchers and Western officials as tied to Iran’s Ministry of Intelligence.
Researchers say the group operates as part of a broader cyber unit known as Banished Kitten, also referred to as Storm-0842 or Dune, which they link to the ministry’s Domestic Security Directorate.
The group has been linked to cyber operations against Israeli infrastructure and public institutions for around two years.
In January, it claimed responsibility for a cyberattack on Israeli kindergartens that disrupted public address systems at about 20 locations. In August, the group was linked to hacks targeting multiple Israeli entities, including academic institutions, technology firms, media outlets and industrial companies.
Handala has also been linked to cyber operations targeting Iran International, a London-based Persian-language broadcaster. In July, Iran International said leaked materials published by Iranian state outlets originated from earlier hacks carried out in the summer of 2024 and January 2025.
The broadcaster attributed those hacks to a broader cyber unit known as Banished Kitten. The channel said the hackers may have installed malware through compromised Telegram accounts. “These cyberattacks are part of a broader campaign of threats targeting Iran International, including physical threats against our staff,” it said.
Iran International said its journalists have faced sustained harassment since the channel was founded in 2017, including threats of assassination and kidnapping, physical assaults, online abuse and hacking.
Iran’s Revolutionary Guards confirmed an armed clash on the Zahedan-Fahraj road, saying “three law enforcement personnel and one ordinary citizen” were killed.
In a statement issued early Tuesday, the Guards’ Qods Ground Forces headquarters said security and intelligence agencies were investigating the incident.
The IRGC headquarters for the southeast is one of ten regional commands and oversees the largest geographic area, covering the provinces of Sistan-Baluchestan and Kerman, and commanding multiple provincial Guards units and key combat brigades in the region.
The rights group Haalvsh, which monitors unrest in the region, earlier reported that the Fahraj incident occurred at a checkpoint in neighboring Kerman province and said four security personnel – two intelligence officers and two police – were killed, with several others wounded. The group published video footage showing injured officers and bodies being transferred from the scene.
At the same time, a second confrontation involving armed assailants and Iranian forces was reported in the city of Iranshahr, also in Sistan-Baluchestan province.
In Iranshahr, Haalvsh said gunmen targeted three military vehicles in the early hours of Tuesday, killing and wounding an unspecified number of security personnel.
The group cited local sources and said roads leading toward Zahedan were blocked by military forces, leaving travelers stranded with no indication of when routes would reopen.
Iranian authorities have not released casualty figures for the Iranshahr attack, nor have they commented on the identity or motives of the attackers. No group has officially claimed responsibility for either incident.
The attacks are the latest in a series of armed confrontations in Iran’s impoverished southeast, which borders Pakistan and Afghanistan and has long been plagued by violence involving Sunni Baluch militant groups and Iranian security forces.
Pattern of attacks and militant regrouping
In recent months, similar clashes have intensified. Last week, the Guards said four of their members were killed and three wounded in an attack by what they described as “terrorist and hostile groups” in the Lar area near Zahedan.
A day later, Haalvsh reported that a newly formed coalition calling itself the “Popular Fighters Front” claimed responsibility, saying it had ambushed a Guards convoy.
The Popular Fighters Front announced its formation earlier this month, presenting itself as a merger of several Baluch political and militant factions, including the PADA Baluch Movement, Harakat Nasr Balochistan, Jaish al-Adl, the Mohammad Rasulallah group led by Haji Vahed Bakhsh, and self-described “spontaneous Baluch fighters.”
In a video message posted online, a masked spokesman identified as Mahmoud Baluch said the coalition aimed to increase the effectiveness of resistance against what he described as oppression by Iran’s ruling system.
While the group’s manifesto emphasized civil, media and political action, it did not renounce armed operations and claimed responsibility for recent attacks.
Jaish al-Adl – designated a terrorist organization by both Iran and the United States – has emerged as the dominant force within the coalition, analysts say.
The group formed around 2012 after the execution of Abdelmalek Rigi, the leader of its predecessor, Jundullah, and has since carried out bombings, ambushes and suicide attacks against Iranian police, border guards and the Revolutionary Guards.
Iranian state-linked media have sought to downplay the significance of the merger, portraying it as a rebranding of weakened factions aimed at attracting foreign backing. Some outlets have alleged links to Israeli intelligence, a claim the groups deny.
Shift in strategy
Security analysts say the emergence of the Popular Fighters Front reflects an attempt by Baluch militants to broaden their appeal beyond a narrowly defined Sunni ethnic insurgency.
Recent statements from the group have adopted more inclusive language, addressing Kurds, Arabs, Turks and other minorities and framing their struggle in terms of shared political and economic marginalization.
The shift follows years of intensified counterinsurgency operations by Iranian forces in Sistan-Baluchestan, including arrests, cross-border pressure near Pakistan, and heightened surveillance. Despite this, militant groups have continued to demonstrate the capacity to stage deadly attacks.
Iran’s southeast remains one of the country’s poorest regions, with longstanding grievances over discrimination, underdevelopment and heavy-handed security policies.
These tensions flared during the nationwide protests of 2022, when security forces carried out lethal crackdowns in Baluch and Kurdish areas.
According to an article by US-based Al-Monitor news website this week, while transforming a Baluch-based insurgency into a national movement would require organizational depth and cross-ethnic networks that militant groups have historically lacked, the new coalition “adds a layer of political complexity” for Tehran.
The message emerged at a joint meeting between media and tourism officials hosted by the strategic council of Iran’s Ministry of Cultural Heritage, Tourism and Handicrafts and the media affairs department of the Ministry of Culture and Islamic Guidance, according to ISNA.
Participants said tourism increasingly depends on professional narrative-building to counter negative perceptions and present Iran’s security and cultural capacity to foreign audiences.
Officials argued that media should move beyond a passive role and become an active partner in promoting tourism and related industries.
Mohammadreza Norouzpour, deputy media affairs minister, said tourism cannot gain visibility without media engagement and that effective communication requires sustained, credible storytelling.
He said developing a participatory model between media and tourism actors was essential to reposition the sector domestically and internationally.
Speaking at the meeting, Mohsen Haji Saeid, head of the tourism working group and chairman of the national association of tour guides, said restoring Iran’s image abroad – especially following the recent conflict – was now the core issue facing the tourism industry.
He criticized traditional promotional approaches and called for a comprehensive information bank to present data on safety and tourism potential.
Other speakers emphasized the role of private-sector participation, health tourism, visual content, and the use of tour guides as cultural ambassadors.
Officials also discussed leveraging major international events, such as the World Cup, to amplify Iran’s narrative.
The meeting concluded with agreement to continue the tourism working group’s activities on a permanent, issue-driven basis, aimed at strengthening media-tourism coordination and improving perceptions of Iran among domestic and international audiences.