As military strikes dominate the headlines, a quieter but significant battle is unfolding online, one that highlights how modern conflicts are fought as much online as on the ground.
An Iranian hacker group known as Handala has been using Starlink, the satellite internet service owned by Elon Musk, to remain online during the ongoing US-Israeli strikes on Iran. According to Israeli cybersecurity firm Check Point, the group has relied on Starlink since at least January, after Tehran imposed internet shutdowns.
Cyber experts cited by Forbes say Handala operates under the direction of Iran's Ministry of Intelligence and Security and has recently claimed cyberattacks against Israeli officials and regional energy infrastructure. Starlink terminals are officially banned in Iran but are widely smuggled into the country through black markets, allowing tens of thousands of users to bypass state controls.
The revelations highlight an unintended consequence of efforts to keep Iranians connected: while satellite internet has helped activists circumvent censorship, it has also enabled state-linked hacking groups to stay active. Following the latest strikes, pro-Iranian cyber teams have escalated online attacks, underscoring how digital warfare continues alongside the military campaign...
"They're the most notorious hacking group the regime uses," says Gil Messing, chief of staff at Check Point.