Paper Threats, State Wars: Water and Power as Weapons

Leaflets turned up in the Tel Aviv area on Monday, and by the time anyone had picked one up, two state security bodies had claimed the case. The Israel Police and the Shin Bet announced they would open an investigation into flyers allegedly linked to the Iran-linked hacktivist group Handala, which threatens Israel's water and electricity infrastructure.

The text is pure threat theater. "Not a single power plant, refinery, or desalination plant will remain in the occupied territories. From south to north, your energy and water arteries will shatter like glass," it reads. Police said the circumstances of the distribution are under investigation. According to an initial police assessment, Tel Aviv residents found leaflets carrying a QR code that led to a webpage the police deemed "suspected threatening content," linked to Handala. Anyone who finds one has been told to contact the authorities.

The Threat Is Aimed at the Pipes, Not the Palaces

Read the flyer closely and notice what's being held hostage. The group says it will act if Israeli leaders "attack the energy infrastructure of the Resistance Front." The warning describes a future in which, in its words, "darkness and thirst will be your only companions, day and night," with people forced "to spend your lives in the depths of shelters devoid of electricity, water, and hope." Its closing line is a demand that Israelis choose "wisdom, or sinking into the darkness and silence of disaster."

The people who would sit in that darkness are the ones who don't run anything. The ministers who decide whether to strike an adversary's energy sites don't lose their taps first. Neither do the officials in Tehran who might sponsor a campaign. Water and electricity belong to everyone who flushes a toilet or keeps insulin cold, and the leaflet treats them as bargaining chips between rival governments.

Independent Organization, Intelligence Ministry Paycheck

Handala portrays itself as an "independent organization." The base record says otherwise: according to a US Justice Department assessment, the group has ties to Iran's Intelligence and Security Ministry. The article itself notes that hacktivist groups don't work for a specific state's intelligence operations but are sometimes sponsored by state actors to carry out cyberattacks on enemy nations. A group dressing up as grassroots insurgency while drawing on a ministry's backing is not a movement from below. It's a state operation wearing a mask, and it asks to be read as popular resistance.

Handala has been one of the main groups targeting Israel since the October 7 massacre in 2023, a date now past its third anniversary, with the region in the fourth year since. The Iran war began in late February 2026, about nine months ago.

The Defense Establishment Counts Its Hits

On the other side of the screen, Israel's cyber bureaucracy is busy with its own numbers. Microsoft's 2026 Digital Defense Report, published October 5, about one month ago, ranked Israel the second-most targeted country in the world and first in the Middle East. The United States led with 531 observed events and Israel logged 210, followed by Taiwan at 193 and Japan at 172, before a significant drop-off to the United Kingdom in fifth. The report said Israel experienced a 21% surge in ransomware attacks since 2025.

Israel National Cyber Directorate Chief Yossi Karadi described Israel as "in an intense campaign in cyberspace and standing at the forefront of global threats." He said that Israel maintaining functional continuity under such a volume of threats "is not to be taken for granted," calling it "the result of an integrated national defense system in which the INCD operates alongside defense bodies, government ministries, the economy, the cyber industry, and global companies." Cyberspace, he said, might have "no missiles in the air, but the fight is waged on a 24/7 basis."

Note the roll call: ministries, defense bodies, the economy, global companies, all folded into one "integrated national defense system." The chief of a state directorate describes the whole society as one apparatus, and the opposing camp's flyer does the same in reverse, addressing "you" as a single target. Both sides are fighting a war in which the civilian is only ever the terrain.

Neither the leaflet nor the investigation asks anyone who lives in Tel Aviv what they want. A QR code, a police probe, a Shin Bet file, a ministry-backed hacking crew. The only people absent from every layer of this story are the ones who would actually go without water.