Skip to content
SPECIAL

THREATS TO CRITICAL INFRASTRUCTURE IN IRAN CONFLICT

READ MORE

Sensing ‘renewed outbreak’ of war, Iran hackers vow ‘dozens’ of ‘devastating’ infrastructure attacks ready

A U.S. Marine Corps F-35B Lightning II lands aboard USS Tripoli (LHA 7), April 6, 2026, during Operation Epic Fury. (U.S. Marine Corps photo)

By Bridget Johnson

Iranian hackers said today that they have detected “preparations for the renewed outbreak of military conflict in the coming days” and would respond to U.S. and Israeli actions with “devastating” widespread attacks targeting energy and IT infrastructure.

President Donald Trump told reporters Wednesday that the latest negotiations between the United States and Iran could “save war,” but “if we don’t get the right answers, it goes very quickly.”

“We’re all ready to go. We have to get the right answers,” Trump said. “It would have to be a complete 100% good answers, and if we do, we save a lot of time, energy and lives, most importantly.”

Iran’s Islamic Revolutionary Guard Corps said in a Wednesday statement that if attacks on the Islamic Republic resume “the regional war that was promised will this time be extended beyond the region, and our crushing blows will bring you to ruin in places you cannot imagine,” according to Iran’s semi-official Mehr news agency.

Handala, a hacking group linked to the Iranian government, claimed credit for a massive wiper attack on a U.S. medical technology company at the start of the Iran war and, later, the breach of the FBI director’s personal email. Yet the group declared at the time a ceasefire began in early April that although it would not recognize a cessation in hostilities it had still “postponed overt confrontation” with the United States per “highest leadership” orders.

Earlier this month, Handala claimed in a Telegram post that strikes on Fujairah oil facilities were part of a coordinated cyber-physical offensive with the IRGC targeting the United Arab Emirates port city — “a fully coordinated operation” that began with their breach of port systems and was followed by kinetic attacks “minutes later.”

Today, in a statement posted on their Telegram and X accounts, Handala said they believed more war is coming based on “an investigation into certain covert accesses” into U.S. and Israeli “military and security systems.”

OSINT EVERY MORNING: In your inbox or online

“Suspicious enemy activities indicating preparations for the renewed outbreak of military conflict in the coming days have become apparent,” Handala said. “Therefore, as previously declared by the Islamic Revolutionary Guard Corps (IRGC), should the enemy commit another act of aggression or recklessness, the Handala Cyber Command, in full coordination with the IRGC, will launch devastating transregional strikes against the energy and digital infrastructure of hostile states.”

“The joint operations command of the Handala Cyber Command and the Islamic Revolutionary Guard Corps has identified dozens of legitimate targets deep within enemy territory across multiple countries,” the statement continued. “At the very opening moments of any conflict, through combined cyber, missile, and drone operations, they will deliver devastating blows to Great Satan.”

Three days before the April 8 ceasefire began, Handala claimed that they were poised to inflict water, electricity and oil sector attacks on the United States and its allies of a caliber to “send your lives back to the Middle Ages” if the U.S. hit Iran’s power grid, as Trump threatened.

After the ceasefire between the U.S. and Iran was announced, Handala said it “continues its cyber operations” against Israeli infrastructure “at full force” despite following orders to suspend “overt” operations against the United States.

“Rest assured: when the time comes, the darkest of nights will have only just begun for America and all its supporters,” the group vowed. Handala also claimed that some of its hackers have been among the war’s death toll.

Handala has also been recruiting, issued an April 6 appeal to “all cyber resistance fighters” to “join the united front of cyber struggle.”

The new statement from the group said that “anonymous sons in Handala and the Islamic Revolutionary Guard Corps are more prepared than ever to avenge and seek retribution for our martyred leader, and they will bring a burning hell upon the enemy.”

WATCH: The cyber dimension of the Iran conflict

Click to listen highlighted text!