Election-day warnings of Iranian hacking rest on a forecast and a partisan relay

PJMedia published a piece on 2 November relaying a Telegraph report that Iranian officials are seeking to recruit agents inside Israeli and US election processes and have established cyber groups to hack election systems, including an unnamed official saying: “We would like to see a divided America and a divided Israel.” That quote reaches readers third-hand — an anonymous Iranian source, via the Telegraph, via an openly partisan outlet whose surrounding copy argues the Trump administration should have “finished off the regime before the midterms.” The Files has not read the Telegraph original and is not running the quote as evidence. The other two pillars are no sturdier: a 30 October threat-intelligence newsletter forecast that Iranian-aligned personas would “keep claiming leaks and DDoS, including U.S.-targeted claims around November 3,” which is an analyst’s prediction rather than an agency warning; and CISA advisory AA26-097A on Iranian-affiliated actors exploiting programmable logic controllers, which dates to early July and is roughly 104 days old.

The prior worth holding comes from the Israeli election ten days ago. Handala — attributed by the US Justice Department to Iran’s Ministry of Intelligence in March 2026 — announced a 13-night leak countdown on 14 October, exposed the commander of the IDF’s Yahalom unit on 20 October with schedule, family photos and files (Haaretz, 24 October), and on polling day itself posted images of bouquets and letters it said were left near polling sites, a self-claim on its Telegram channel reported by The National. A Check Point review of the 2026 Israeli elections found that Handala’s claims far outnumbered verified compromises. Separately, ESET’s APT activity report, publicised from Jena on 2 November, found Iran-aligned groups resuming Middle East operations with Israeli organisations as the principal focus, and MuddyWater breaching US banks and airports with a new backdoor — an attribution resting on digital certificate overlaps, which are suggestive rather than conclusive.

Assessment: The useful metric today is not whether Iranian-aligned actors post something. They almost certainly will. It is the ratio between what is claimed and what is independently verified, and the speed at which claims get amplified as events by people with a reason to want them true. Handala’s October run is the control group: a leak countdown and a bouquet photograph generated more coverage than the one documented intrusion. ESET’s Jean-Ian Boutin makes the adjacent point about AI, arguing that it makes individual attacks more efficient and lowers entry barriers somewhat, while target selection and execution remain largely manual — the expected revolution in cybercrime has not arrived. Vendor marketing says otherwise. So does an election-eve news cycle.