Handala Hackers Targeted Israeli Officials by Compromising Telegram Accounts

**Executive Summary:** The Iranian-linked group Handala claimed full compromise of mobile devices belonging to Israeli political figures, but Kela analysis found the intrusion was limited to Telegram account takeovers and leaked Telegram data (contacts and roughly 1,900 conversations, most of which were empty). The report outlines probable TTPs—SIM swapping, SS7 interception, phishing, session hijacking using Telegram Desktop tdata, and OTP harvesting—and warns that Telegram's default settings (optional cloud password and cloud-stored chats) and weak session management increased account takeover risk.