Iranian state media has begun confirming that Israeli strikes during the recent war killed the commander behind the Handala Hack Team, one of the Islamic regime’s most active cyber groups targeting Israel.
The acknowledgment is the first public admission from Iranian sources that senior figures inside Handala were killed during the conflict and may point to broader losses inside one of Iran’s most prominent offensive cyber units.

A Telegram channel affiliated with the intelligence organization of the Islamic Revolutionary Guard Corps identified the commander as Yahya Hosseini Panjaki, AKA Yahya Hamidi.
According to the channel, Panjaki led Handala and was killed in an Israeli strike during the opening hours of the war. Israel had previously announced that it eliminated several senior officials from the Ministry of Intelligence, including the deputy minister responsible for Israel affairs. Iranian sources later confirmed that official was Panjaki.

Panjaki was not an ordinary intelligence officer. Western governments and cybersecurity firms had tracked him for years as one of the Islamic regime’s senior cyber operators. He also headed a unit known by multiple names, including Banished Kitten, Storm 0842, Void Manticore and Red Sandstorm. The United States sanctioned him in 2024 for his role in offensive cyber operations. According to Check Point Research, he directed activities under the Ministry of Intelligence’s Internal Security Deputy, including its counterterrorism division, while overseeing cyber campaigns against foreign targets.

Another development suggests Panjaki may not have been the only member of Handala killed during the war.

A photograph (see above) circulating on Iranian Telegram channels and attributed to Fars News shows 6 men seated together around a small celebration. The accompanying caption states that everyone in the image was martyred and identifies them as cyber specialists from the Sarboland Hacking Group "Hanzalah", another name associated with Handala. The post provides no names, dates or circumstances of death, and no independent organization has verified the identities of the men in the photograph.

If authentic, the image would indicate that Israeli strikes reached beyond Handala’s leadership and into its technical ranks. At present, however, there is no public evidence identifying the 6 men or confirming when they were killed. Iranian officials have also not released any formal casualty list for the group.

Reports from other sources point in the same direction. The Irish Examiner previously reported that Handala was forced to reorganize after losing 2 of its leading figures during the war. While that report does not mention the Sarboland photograph, both accounts suggest the group suffered significant disruption during the conflict.

Handala first appeared in December 2023, only weeks after the October 7 Hamas attack on Israel. Initially presenting itself as a pro Hamas hacking collective, it rapidly evolved into one of the Islamic regime’s most aggressive cyber fronts. Over the following 2 years the group combined network intrusions, data theft, destructive malware and psychological operations targeting Israeli government institutions, military personnel and civilian organizations.

The U.S. Department of Justice has described Handala as a fictitious online identity operated by Iran’s Ministry of Intelligence and Security to conceal state sponsored cyber operations. Cybersecurity firms including Palo Alto Networks Unit 42 and Check Point have reached similar conclusions, identifying Handala as part of the Islamic regime’s intelligence apparatus rather than an independent hacktivist organization. Iran International has also reported that the group operates under the Ministry’s Domestic Security Directorate.

Under Panjaki’s leadership, Handala claimed responsibility for a series of high profile cyber intrusions against Israeli officials.

The group alleged it had compromised the personal phones of former Prime Minister Naftali Bennett, former IDF Chief of Staff Herzi Halevi and Netanyahu’s former chief of staff Tzachi Braverman. It also published or threatened to publish material it claimed came from former Defense Minister Yoav Gallant, former Mossad director Tamir Pardo, former Prime Minister Ehud Barak and Benny Gantz. Some of those claims could not be independently verified, but the group’s operations established it as one of the Islamic regime’s most visible cyber brands.

Its largest operation during the war targeted Michigan based medical technology company Stryker. Handala claimed the March 2026 attack erased data from more than 200,000 devices operating in 79 countries, disrupting medical supply chains serving hospitals in the United States and elsewhere. The group said the attack was retaliation for a U.S. strike on a girls school in Minab during the opening hours of the conflict. Afterward, the U.S. Department of Justice seized domains linked to the operation, including Handala Hack and a related website used to publish personal information about individuals connected to the Israeli military.

Handala’s online activity also showed signs of disruption during the war. At one stage several of its communication channels fell silent around the same time Israel announced strikes on what it described as the Islamic regime’s cyber warfare headquarters in Tehran. Neither side directly connected those events, but the timing drew attention from cybersecurity researchers monitoring the group’s activity.

The confirmation of Panjaki’s death now provides the clearest indication yet that Israel’s campaign extended beyond missile bases, nuclear facilities and military headquarters to include the Islamic regime’s cyber leadership. Whether the Sarboland photograph reflects additional confirmed casualties remains unknown, but Iranian officials have so far released only limited information.

How many members of Handala were killed may not become clear for some time. Iran has often acknowledged sensitive losses weeks or even months after they occurred, frequently through IRGC affiliated channels rather than formal government announcements. For now, Panjaki’s death has been confirmed by Iranian sources. The identities of the other men shown in the Sarboland photograph, and the full extent of the damage inflicted on one of the Islamic regime’s most active cyber units, remain unanswered.