Iran's Hacker-in-Chief Eliminated

Also, the ultra-Orthodox: Netanyahu's Achilles' heel or hidden strength? Out of tragedy, hope, and more.

It’s Thursday, June 25, and before we get to today’s articles, an update. A senior U.S. official told Reuters that Israel has withdrawn from part of southern Lebanon, with the Lebanese army set to deploy in its place. According to a senior Israeli official, the move is a “goodwill gesture” toward the Lebanese government. For now, officials in the political echelon are denying the report. On the ground, the IDF is claiming they have not yet received any order to withdraw, which may indicate that such an order will come in the next few days. If accurate, the pullback would likely be from additional territory Israel seized in recent days specifically in order to be handed back as an initial concession.

This is a developing story. On to today’s articles.

---

Head of the Handala hacktivist collective Seyed Yahya Hosseini Panjak. (Abu Ali Express/Edited with Gemini)

For more than two years, a barefoot cartoon boy was the mascot of “Handala,” a self-described pro-Palestinian hacktivist collective that leaked the private photos of Israeli generals, wiped the servers of a Fortune 500 company, and broke into the personal inbox of the FBI director. The group insisted it was a grassroots resistance movement. It was not—and the IRGC has now confirmed that the man who actually ran it faced kinetic consequences for his digital warfare.

Seyed Yahya Hosseini Panjaki, who operated under the alias Yahya Hamidi, was killed in early March 2026 during the opening phase of Israel’s strikes on Iran. The Israeli military confirmed he died in a strike on the headquarters of Iran’s Ministry of Intelligence and Security (MOIS), part of a wave of precision operations against senior intelligence figures.

What was the leader of a grassroots hacktivist collective doing inside Iran’s intelligence nerve center? The answer is that he had never really been one. As Western intelligence had long suspected, “Handala” was a front for the MOIS. Cybersecurity firm Check Point named the underlying unit Void Manticore; others label it Banished Kitten, Storm-0842, Dune, Red Sandstorm, or TAG-145. The names differ, but they converge on the same entity: a state cyber-warfare unit embedded within Iran’s intelligence ministry.

Yesterday, for the first time, an IRGC-linked channel publicly tied Panjaki to the leadership of the hacking operation—a rare instance of Tehran acknowledging what Western intelligence had assessed for years. His death marks one of the most significant blows in years to Iran’s cyber-espionage apparatus and its overseas covert-operations network.

Handala surfaced in December 2023, just weeks after October 7, taking its name and imagery from the barefoot child drawn by Palestinian cartoonist Naji al-Ali in 1969, a symbol of the Palestinian national movement. Early posts cast the group as “a small fighter” aligned with Hamas before it pivoted to broader anti-Israel and anti-American messaging.

Its notoriety came from a relentless cadence of breaches and leaks designed to humiliate Iran’s enemies. In April 2026, it published what it said were more than 19,000 confidential images and videos pulled over years from the phone of former IDF Chief of Staff Herzi Halevi—including imagery from undisclosed meetings abroad. Earlier leaks targeted former PM Naftali Bennett, former Justice Minister Ayelet Shaked, Netanyahu’s chief of staff Tzachi Braverman, and figures such as Benny Gantz and Natan Sharansky.

In March 2026, it claimed to have breached the personal Gmail of FBI Director Kash Patel. Washington, in response, offered up to $10 million for information on the group’s members. The most consequential operation, however, was a destructive wiper attack on Stryker Corporation, the Michigan-based Fortune 500 medical-device maker, which reportedly wiped devices across the company’s global footprint—described as the most significant wartime cyberattack ever carried out against the United States.

Panjaki’s reach went well beyond cyber, into the wider machinery of Iran’s “grey-zone” warfare; that murky space that is neither open war nor peace, where a state attacks its enemies but stays just below the line that would trigger a military or legal response.

In Iran’s case—and Panjaki’s specifically—that meant operations to assassinate Iranian dissidents living abroad, along with kidnappings and sabotage against regime opponents and Israeli targets around the world. His fingerprints are on a recent wave of Iranian plots that hire local criminal gangs to attack Jewish targets globally—schemes that have been broken up in Spain, the United Kingdom, Australia, and even Sweden. That outsourcing is a microcosm of the whole grey-zone game: by paying a hired crew to do the killing instead of using its own officers, Tehran can deny involvement, make the attack hard to trace back, and slow down any response.

Western countries often struggle to fight this ambiguous kind of warfare. Their systems are built to treat a problem as either a crime for the police or an act of war for the military, so an attack that is deliberately neither falls through the cracks while agencies argue over whose job it is to respond. Western states are also instinctively reluctant to play the same game, often seeing this kind of covert subterfuge as unethical or too provocative—which leaves Tehran free to inflict real harm while rarely paying a price for it.

Operations like Handala’s are not just data theft—they are influence operations, built to humiliate a target’s leadership, expose its secrets, and stir up internal strife. Leaked emails and images of Israeli officials, a wiped hospital network, or a fake rocket siren played into a kindergarten do real damage to public trust and national morale, yet each arrives wrapped in enough deniability that the victim state can rarely hit back as if it were an act of war. In Israel, Iranian influence operations have focused on the war itself—sowing distrust and demoralization, inciting violence against Arab citizens, and spreading general chaos. Internationally, they have pushed libels and anti-Israel content, contributing to Israel’s destruction in the public square.

Panjaki’s comeuppance seriously disrupted Iran’s hack-and-leak leadership and its overseas-operations network, but it did not end Handala, nor Iran’s broader grey-zone campaign. Israel and the West face a serious, lasting challenge from operatives like Panjaki—and the clearest lesson of his death is the one Tehran understands best. Grey-zone operations are acts of war, and as it has become increasingly clear, the only way to stop Iran’s malicious activity is to ensure it faces real, explosive consequences.

---

Ultra-Orthodox Jewish men block Highway 1 toward Tel Aviv during a protest against the imprisonment of yeshiva students who failed to comply with military recruitment orders, near Jerusalem, June 24, 2026. (Chaim Goldberg/Flash90)

What’s been happening over the past two weeks around Netanyahu and the Likud has a name in meteorology: a perfect storm. Fortunately for them, it’s occurring 120 days before the elections—a point by which no election campaign this century had ever started.

Trump’s agreement with Iran undercuts Netanyahu’s political reason for being. The blood price in Lebanon, despite the massive blows Hezbollah is absorbing, damages the arena where a total victory was achieved last year. The ultra-Orthodox road blockades and the weekly legislation in the Knesset repeatedly expose, to the undecided, the Achilles’ heel of the entire bloc. If this is the situation on election day, Netanyahu is in trouble.

One of the reasons the right usually does better at the ballot box than in the polls is the ultra-Orthodox vote. Take a sky-high turnout rate, multiply it by the highest birth rate in the Western world, and you’ve got another two seats. In the last elections the ultra-Orthodox parties won 17.5 seats, which became 18 due to Israel’s vote-counting system. In most polls today they get only 16 seats, so ostensibly there are another four easy seats here.

Unless the surprise works in reverse this time. Ultra-Orthodox politicians, journalists, and influencers point to the possibility that turnout will crash. The ultra-Orthodox public is bitterly disappointed with its elected officials, most of whom have been around since the last millennium. It blames them for the sanctions and the arrests and believes they failed badly in the outgoing term.

The legislative blitz described in the general press as ultra-Orthodox greed and hubris is more of a panicked dash by Shas and United Torah Judaism to prove to their voters that they’re doing something after all. That’s also why the flagship Agudat Yisrael organizations organized the massive disruptions on Israel’s roads, in cooperation with the fringe extremist Jerusalem Faction.

The ultra-Orthodox were far from the country’s most popular group even before they decided to add a few hours to everyone’s commute. Recent polling confirms that the protests have only deepened public hostility toward them. But to read that as a failure is to misunderstand the point of the disruption. It isn’t about winning sympathy; it’s about fervor—about showing a community that its leaders are not impotent, and are worth re-electing. Will it work? That remains to be seen.

---

Miriam Shani and Ofek Dotan at thier wedding on Tuesday.

Out of the bereavement of October 7, a powerful moment of comfort and renewal emerged earlier this week. Miriam Shani, the widow of the late Capt. Ori Shani, a hero of the October 7 battles, married Ofek Dotan, who had once been one of Ori’s commanders.

Under the wedding canopy, Ori’s father, Yehoshua—a prominent voice in the hostage debate—welcomed the marriage.

“After a period of pain and longing beyond words, we have merited to see a new light enter our lives,” he said.

“Ori is with us at every stage and accompanies us in every step, including today,” Ofek said. “Miriam and I are going to build a home together—a second floor on strong foundations planted deep in the ground. Thank you for the first floor. Thank you for everything.”

Ori, a platoon commander in the Golani Brigade, fell on October 7 while battling the Hamas invasion of the Kissufim outpost.

That morning, Ori and five of his soldiers were on a routine patrol of the border. When the invasion began, his unit tried to fight off the attackers but was badly outgunned. Ori’s brother, Yishai, recalled that Ori texted him that morning: “Pray for us, we have no ammo, no water.”

After more than eight hours of fighting near the border—during which they killed many Hamas terrorists—Ori and his team returned to the Kissufim outpost to resupply. As they did, mortar fire struck their position, killing Ori instantly.

After just a year and a half of marriage, his wife, Miriam, and their son, Roi, were left without a husband and father.

“What kind of world is this, where the wheel of life does not stop?” Ofek said. “A world where light and darkness are mixed together, where a rabbi becomes a student and a commander becomes a partner on the path. Circles close and open again without end.”

It’s a complicated world we are living in, but all of Israel wishes Miriam and Ofek an easy journey moving forward.

---

“I’ll say it impolitely: shut the f* up.”**

Pardon the profanity, but that’s my advice to Israel’s leaders going forward. If it wants to keep its operational freedom in Lebanon—and maybe return to striking Iran—that’s simply what it has to do.

Also: could Trump’s endorsement actually tank Netanyahu’s election chances? And could it hand Gadi Eisenkot the premiership? I get into all of this and more with Dan Senor on the latest episode of Call Me Back.

To listen to the episode click here.

---

English Editor: Ari Tatarka

---

If you enjoy the newsletter, you can show your support by becoming a paid subscriber—it really helps keep this going. I’m also offering a special monthly briefing for a small group of premium members. I’d love to have you join us—just click below to find out more.

Thanks for reading It’s Noon in Israel! Subscribe for free to receive new posts and support my work.