Digital War: Hackers Threaten US Military Personnel in the Persian Gulf with Personal Retribution
The 'Handala' group sends threats using Shahed drones to the personal phones of US service members in Bahrain, where the 5th Fleet is based.
'Digital Jihad': Iranian Hackers Target US Military Personnel in Bahrain, Threatening Retribution
Introduction
On April 28, 2026, US service members stationed at the naval base in Bahrain — at the heart of the US Naval Forces Central Command (NAVCENT) headquarters — received messages on their personal phones that can only be described as an act of psychological terror.
"Your identities are fully known to our missile units. Every move you make is under our surveillance. Very soon, you will become targets of our Shahed drones and Kheibar and Ghadir missiles," the text read. "We advise you to call your families right now and say goodbye."
The hacktivist group, calling itself Handala, claimed this was just the beginning. The next day, the group's Telegram channel announced a leak of personal data of 2,379 US Marines involved in the blockade of Iranian ports in the Persian Gulf.
This event marks a new phase in hybrid warfare — a shift of Iranian cyber operations toward direct, personal threats against enemy service members, blurring the lines between virtual espionage and real-life danger.
Event Details and Timeline
The first wave of attacks came on Monday, April 28. Messages were sent via WhatsApp from a Bahraini phone number that turned out to belong to a legitimate local business — likely hacked or compromised.
The text of the messages was identical for all recipients. In addition to the direct threat of using Shahed drones (Shahed-136, an Iranian kamikaze drone) and ballistic missiles, the message contained a political justification: service members were called "terrorists whose hands are stained with the blood of Minab schoolgirls." "Minab schoolchildren" refers to an incident in the Iranian port city of Minab, which, according to Tehran, suffered from US bombings.
The next day, April 29, Handala published a detailed file with personal data on Telegram. The leak allegedly included names, ranks, contact information, and details about operational roles and off-duty activities. This allowed the hackers to claim: "We know everything."
The Handala group itself is no newcomer to cyberspace. Active since at least 2008, it operates under various names: Banished Kitten, Void Manticore, Storm-0842. In March 2026, the US Department of Justice officially linked Handala to Iran's Ministry of Intelligence and Security (MOIS). Previously, the group claimed responsibility for hacking the email of FBI Director Kash Patel and a destructive attack on US medical device manufacturer Stryker, allegedly destroying over 200,000 systems.
Impact and Significance (for the world/industry/society)
This attack is not just another hack. It demonstrates a change in the rules of engagement in modern conflicts.
Blurring the line between cyberspace and the physical world. Previously, Pentagon data leaks were the domain of spies and analysts. Now, the threat comes directly to a soldier's personal smartphone. As SOCRadar experts note, Handala is "an intelligence and influence operation, not purely military. The goal is psychological damage and data collection, not just technical disruption." The publication of service members' personal data (doxxing) turns each of them into a potential target not only on the front lines but also for possible attacks on their families in the US.
Panic and loss of anonymity. The most alarming consequence for US command has been the reaction of personnel. According to sources, service members involved in the bombing of Iran are experiencing intense fear for relatives back in the US. Having lost anonymity, they no longer feel safe anywhere.
Harbinger of hybrid warfare. Handala has demonstrated that it can not only intimidate but also inflict critical damage — as with the attack on Stryker, which supplies equipment for the Department of Defense. The operation in Bahrain is a test of the effectiveness of psychological weapons.
Reactions of Key Players
US military command responded quickly but cautiously. The Naval Criminal Investigative Service (NCIS) publicly stated that the threats are part of "ongoing cyber-enabled harassment and misinformation campaigns." In its statement, NCIS emphasized that these messages "are not assessed as indicating a credible or imminent physical threat."
At the same time, a warning was issued at the level of daily orders. Earlier in the month, then-Secretary of the Navy John Phelan ordered all sailors to "lock down their phones and social media accounts" due to increased "social engineering campaigns" by Iran. Service members were advised not to respond to suspicious messages and not to click on links.
From the US Department of Justice — the hunt for hackers continues. In March, four domains linked to Handala were seized, and a $10 million reward was announced for information about group members.
Iranian state media (Press TV) portray the hackers' actions as an act of revenge: "retribution for the blood of Minab's children." Tehran does not officially take command of the group but does not distance itself from its successes, using them to boost morale domestically and demonstrate its "long arm" abroad.
Forecast and Conclusions
The situation with Handala only confirms a sad trend: modern warfare is inevitably becoming total. If soldiers once risked only on the battlefield, today their personal information, their families, and their psychological state have become legitimate (in the enemy's view) targets.
Near-term outlook. Attacks will continue and likely become more severe. Doxxing threats will be used for blackmail or recruitment. Countering this is extremely difficult: even if a service member locks down their social media, their data can leak from relatives or through third-party services.
Technological challenge. The Pentagon will have to revise digital hygiene rules for service members. However, completely banning the use of smartphones and WhatsApp in combat zones is impossible.
Geopolitical aspect. This attack shows that Iran, even losing in conventional naval warfare, retains a powerful weapon in cyberspace. The destruction of undersea internet cables in the Strait of Hormuz, previously warned about by Iranian agency Tasnim, remains a real scenario.
The conclusion is clear: information and psychological operations have come to the forefront. Shahed drones may not reach an aircraft carrier, but the fear sown by a WhatsApp message has already caused damage. US military personnel no longer feel safe — and that is Handala's main victory.
— Editorial Team
