Beginning in September 2024, the Iranian-aligned hacktivist group Handala launched a sustained campaign targeting the personal communications of senior Israeli political and military figures. Dubbed "Bibi Gate" by the group, the operation culminated in December 2025 with the claimed breach of Tzachi Braverman's phone, a close associate of Prime Minister Benjamin Netanyahu, and the systematic leaking of materials every Saturday under the banner "Saturday Files."
Confirmed Targets
Over the course of the campaign, Handala claimed to have compromised the accounts of multiple high-profile Israeli officials including former Prime Minister Naftali Bennett with 200,000 messages allegedly obtained, former Prime Minister Ehud Barak with approximately 110,000 emails from personal and official accounts, former Foreign Minister and IDF Chief of Staff Gabi Ashkenazi with 60,000 emails reportedly stolen, Israeli Ambassador to Germany Ron Prosor with 50,000 emails exposing diplomatic communications, and senior Netanyahu aide Tzachi Braverman whose phone data was claimed on December 28, 2025.
Technical Assessment
KELA Cyber Intelligence assessed that the breaches were restricted to Telegram account access rather than full device compromise. The most probable attack vectors include social engineering or spear-phishing targeting passwords and one-time codes, exfiltration of Telegram Desktop session files (tdata) from compromised workstations, or unauthorized access to cloud backups. Telegram's default security settings create significant gaps: permanent account IDs persist despite username changes, enabling OSINT tracking and profiling.
Psychological Warfare Over Technical Sophistication
Rafael Franco, former deputy head of Israel's National Cyber Directorate, characterized the operation as primarily psychological: the group is not a classic hacker group with deep intelligence capabilities, but rather a loud actor whose main goal is psychological and cognitive influence. The deliberate weekly release cadence and targeting of politically sensitive figures was designed to sustain media pressure and erode public trust in Israel's security establishment.
The leaked Ehud Barak emails were subsequently analyzed by independent journalists, who reported correspondence between Barak and Jeffrey Epstein spanning 2013 to 2016, generating international media coverage that extended the operation's impact far beyond its original Israeli targets.
Attribution
Microsoft has attributed Handala to the Iranian attack group Storm-0842, connected to Iran's Ministry of Intelligence and Security (MOIS). The group also operates under the identities DarkBit and Homeland Justice. Check Point Research independently assesses Handala as a persona of Void Manticore, a confirmed MOIS-affiliated actor. In August 2025, Iran International TV exposed the identities of several members, reporting the cyber unit is led by Yahya Hosseini Panjkhi.