Skip to content
HACKTECH
IsraelReported Published 3 sources

Israel's cyber directorate warns of Iran-linked wiper attacks via stolen credentials

In early March 2026, Israel's National Cyber Directorate (INCD) warned of a wave of destructive cyberattacks on Israeli organisations, which it attributed to Iran. According to the directorate, in most cases attackers got in with authentic user credentials stolen in the past or leaked in earlier attacks, and also exploited a weakness in remote access, then deleted servers, workstations and data. Haaretz reported the INCD said no critical infrastructure had been compromised. The directorate urged password changes, two-factor authentication, checks on administrator accounts, remote-access updates and backups.

  • Israel
  • INCD
  • wiper malware
  • Iran
  • remote access
  • stolen credentials

What the sources report

  • Unit 42's translation of a 6 March 2026 INCD statement says the directorate received reports of several cases in which attackers gained access to corporate networks and deleted servers and workstations. In some cases the attacker used access data from legitimate corporate users to gain initial access.
  • On 9 March 2026 the INCD said it was detecting and countering a wave of cyberattacks attributed to Iran, aimed at destroying data and systems at Israeli companies and organisations, in a campaign spanning multiple sectors (Haaretz; Jerusalem Post).
  • According to the Jerusalem Post, the INCD said that in most cases attackers used authentic user credentials stolen in the past or leaked during previous attacks. They also exploited a weakness in organisations' remote access, and once inside they deleted systems and data.
  • Haaretz reported the directorate said no critical infrastructure had been compromised, and INCD head Yossi Karadi said no organisation essential to the functioning of the home front had been harmed (Jerusalem Post).
  • INCD recommendations: immediately replace remote-access passwords, enable two-factor authentication, verify that no unfamiliar users hold administrator privileges, update remote-access tools to the latest security versions, ensure backups are in place, and report suspected incidents to the 119 emergency centre.
  • In a 12 March analysis, Unit 42 said recent destructive operations by the Handala Hack group reportedly relied on identity exploitation through phishing and administrative access through Microsoft Intune. It added that the threat intelligence community assesses Handala as a state-directed front for Iran's Ministry of Intelligence and Security. The INCD statements as reported do not name a group.

What it means for your organisation

A wiper leaves no ransom to negotiate, so recovery depends on what was in place before the attack: whether remote access requires MFA, whether any unfamiliar account holds administrator rights, and whether a backup the attacker cannot reach has been restored in a test.

What we check

  • On remote-access systems, rotate passwords, enforce MFA and check user accounts against known leaked credential sets.
  • Review privileged group membership in Active Directory, Entra ID and MDM consoles for unfamiliar administrators and standing privileges.
  • Test restoring from offline or immutable backups after a simulated mass deletion of servers and endpoints.
  • Confirm that mass delete and remote wipe actions in MDM (for example Intune RemoteWipe and FactoryReset) and admin sign-ins from new locations raise alerts.
  • Run a tabletop exercise on a destructive attack, covering decision-making, communications and reporting to the INCD's 119 centre.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works