Handala: From Cartoon Symbol to Cyber Warfare Signifier

A pin depicting Handala, a Palestinian cartoon character created by Naji Al Ali, gained attention at the 2026 Academy Awards when worn by Spanish actor Javier Bardem. Beyond its political symbolism, the Handala image has recently emerged as a signifier for a cyber warfare group allegedly linked to Iran.

The Origins of Handala

Handala, a barefoot cartoon boy, was created by Palestinian political cartoonist Naji Al Ali in 1969. The character took on its most recognizable form – hands clasped behind his back and face turned away from the viewer – in 1973. Over time, Handala became an enduring emblem of Palestinian identity and defiance. Al Ali, born in Galilee in 1938, was forced to flee with his family in 1948 during the Nakba and grew up in Ain al-Hilweh refugee camp in southern Lebanon.

Al Ali produced over 40,000 cartoons published across the Middle East, with Handala often serving as a silent witness to unfolding events. The character is depicted as a 10-year-traditional refugee, the age Al Ali was when he left Palestine, and the cartoonist stated Handala would never grow older until able to return home. The turned back and clasped hands symbolize a rejection of imposed solutions, while the bare feet and ragged appearance reflect the hardship of refugee life.

Handala Hack Team and Cyberattacks

Recently, the name “Handala” has been associated with a cyber warfare group, the “Handala Hack Team,” which experts believe is connected to Iran’s intelligence ministry. The group has been active since after the October 7, 2023, Hamas attack.

In late February/early March 2026, the Handala Hack Team reportedly achieved a significant success by exposing US medical device manufacturer Stryker. The company, with approximately 56,000 employees and $23 billion in revenue in 2024, experienced an attack affecting its “Microsoft environment,” with reports of cell phones being remotely reset to factory settings and potential data deletion from several thousand devices. Stryker maintains that medical devices used by customers were not affected.

Experts describe Iran’s cyber strategy as “chaotic, vengeful, and state-sponsored.” The Handala Hack Team is believed to be part of a larger group called Manticore, which has been linked to cyberattacks on government agencies in Albania in 2022, a country hosting an Iranian opposition group.

Psychological Warfare and Iranian Operations

The group has likewise claimed responsibility for attacks targeting the Israeli Shamir Medical Center and the smartphone of a chief of staff to Israeli Prime Minister Benjamin Netanyahu, threatening to publish data. Cybersecurity experts suggest this is a tactic of psychological warfare, aiming to instill fear within Netanyahu’s inner circle.

Intelligence suggests the presentation of the Handala Hack Team as an activist group is a camouflage, and an intelligence officer responsible for the operations was reportedly killed in initial attacks on Iran. Cyber manipulation was also reportedly used by Israel to gather intelligence on Iranian targets through surveillance cameras.