Threat Intelligence Tarot
Vol. II · 141
Iran-aligned (suspected)
★★★★★
risk 3/5
✦ The Watching Child ✦
Handala
Handala Hack · Anti-Israel hacktivist cluster
Israeli organizationsIsraeli citizensCompanies operating in IsraelIsraeli government
Active since ~2023 · Ideological disruption, Anti-Israel messaging, Influence operations
The Watching Child takes its name from a cartoon — a barefoot figure forever turned away, witness and accusation in one. Where political grievance meets state-aligned capability, the child does not blink.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Post-October-2023 emergence with Israel-focused intrusions
- ◆Wiper deployment paired with ideological messaging
- ◆Claimed (disputed) Soreq Nuclear Research Center breach
- ◆Persistent SMS-based mass intimidation campaigns against Israeli citizens
Defenses
- ▸Independent verification of breach claims before public statementsNIST CSF: RS.CO ↗
- ▸SMS phishing awareness training tailored to Israeli citizensNIST CSF: PR.AT ↗
- ▸Wiper-aware EDR detection with focus on Israeli-deployed payloadsMITRE D3FEND
- ▸Critical infrastructure segmentation aligned to INCD guidanceIsrael National Cyber Directorate
Reversed: Their Weakness
Public disclosure of inflated or fabricated breach claims undercuts this operator's primary product, which is narrative rather than data. Skeptical Israeli media coverage has measurably blunted multiple campaigns.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.