How Pro-Iran Hacktivist Networks Mobilize During Kinetic Conflict

This report analyzes a pro‑Iran cyber ecosystem mobilized after U.S./Israeli strikes in early 2026, highlighting Handala’s infostealer-enabled compromise of Stryker that leveraged Microsoft Intune to remotely wipe devices across 79 countries (claimed >200,000 devices), the 313 Team’s massive DDoS/extortion of Canonical/Ubuntu using the commercial Beamed service (claimed >3.5 Tbps capability), and a wide coalition of state‑aligned, nationalist, and opportunistic groups that amplify disruption through DDoS‑for‑hire, credential harvesting, leaks, and propaganda; it concludes defenders should prioritize DDoS readiness, leaked credential and doxxing monitoring, and rapid response/communications.