Hackers say they fed U.S. drone targets to IRGC in response to retaliatory strikes on Iran

Iran hackers said this evening that they are assisting the Islamic Revolutionary Guard Corps with pinpointing drone targets in response to U.S. strikes conducted in retaliation for the earlier downing of a U.S. military helicopter by an Iranian Shahed drone off the coast of Oman.

U.S. Central Command said two crew members from a U.S. Army AH-64 Apache were rescued within about two hours of the Monday night hit.

“I have just been informed by our Great Military that last night the Iranians shot down one of our highly sophisticated Apache Helicopters while patrolling over the Strait of Hormuz,” Trump said on Truth Social this afternoon. “There were two pilots involved, both are safe and uninjured. Nevertheless, the United States must, of necessity, respond to this attack.”

“We prefer the language of diplomacy, but we speak other languages far more fluently. Break your commitments, and we’ll switch to what we speak best,” Iran’s parliament speaker Mohammad Bagher Ghalibaf posted on X afterward. “You ride the horse you saddled!”

At 5 p.m. EST, the U.S. launched strikes against targets that a senior official told The Wall Street Journal included Iranian air defenses and radars near the Strait of Hormuz.

Handala, a hacking group linked to the Iranian government, claimed credit for a massive wiper attack on a U.S. medical technology company at the start of the Iran war and, later, the breach of the FBI director’s personal email. The group declared at the time a ceasefire began in early April that although it would not recognize a cessation in hostilities it had still “postponed overt confrontation” with the United States per “highest leadership” orders.

Shortly after Trump’s Truth Social post, the hackers posted a screenshot of it on their Telegram channel. “The Handala Cyber Command, in a sharp and decisive warning to the terrorist U.S. army, declares that in the event of any action, you will have to retrieve the bodies of your officers from your most secret bases in the region,” they wrote in the post underneath Trump’s words.

After U.S. retaliatory strikes began, Handala posted, “LEAVE PERSIAN GULF COUNTRIES NOW.”

Underneath an image of a Shahed drone, the hackers’ next post at 6:44 p.m. warned, “As Handala revealed the identities of all marines of the terrorist American regime last month, leading to multiple confidential reports in Congress on the matter, the coordinates of all U.S. terrorist military forces in the Persian Gulf countries have now been transferred to the Islamic Revolutionary Guard Corps (IRGC)! Within minutes, you will be ‘welcomed’ by Shahed-136 drones.”

“You started the game; we will determine how it ends,” Handala added.

In early May, Handala claimed in a Telegram post that strikes on Fujairah oil facilities were part of a coordinated cyber-physical offensive with the IRGC targeting the United Arab Emirates port city — “a fully coordinated operation” that began with their breach of port systems and was followed by kinetic attacks “minutes later.”

“This operation once again demonstrates the convergence of cyber and missile warfare on the same battlefield,” the group said. 

On May 21, Handala said that they had detected “preparations for the renewed outbreak of military conflict in the coming days” and would respond to U.S. and Israeli actions with “devastating” widespread attacks targeting energy and IT infrastructure. Handala said they believed more war is coming based on “an investigation into certain covert accesses” into U.S. and Israeli “military and security systems.”

“The joint operations command of the Handala Cyber Command and the Islamic Revolutionary Guard Corps has identified dozens of legitimate targets deep within enemy territory across multiple countries,” the group declared. “At the very opening moments of any conflict, through combined cyber, missile, and drone operations, they will deliver devastating blows to Great Satan.”

Three days before the April 8 ceasefire began, Handala claimed that they were poised to inflict water, electricity and oil sector attacks on the United States and its allies of a caliber to “send your lives back to the Middle Ages” if the U.S. hit Iran’s power grid, as Trump threatened.

After the ceasefire between the U.S. and Iran was announced, Handala said it “continues its cyber operations” against Israeli infrastructure “at full force” despite following orders to suspend “overt” operations against the United States.

“Rest assured: when the time comes, the darkest of nights will have only just begun for America and all its supporters,” the group vowed. Handala also claimed that some of its hackers have been among the war’s death toll.