Handala leaflets reach north Tel Aviv mailboxes, and the claimed scale dwarfs what police confirm

Israel Police said on Monday that leaflets were placed in mailboxes at several locations in north Tel Aviv, directing readers via QR code to a site operated in the name of the Iran-linked group Handala. A police screenshot shows the page titled “warning from handala team”; the text warns that Israeli civilian infrastructure could be targeted in retaliation for attacks on the energy infrastructure of the “resistance front,” and names power plants, refineries and desalination facilities. Fars, the IRGC-affiliated agency, carried the group’s own account, relayed by IranWire: dozens of operatives moving through the city until dawn, distributing “hundreds of thousands” of leaflets under the hashtags #NoWater and #NoElectricity. The statement, as carried by the Times of Israel’s live blog, claims operatives went “door-to-door — without alarms, without any sirens.” Check Point has identified Handala as affiliated with Iran’s Ministry of Intelligence, and the US Justice Department has tied the group’s internet infrastructure to the ministry.

The gap between those two descriptions is the story. Haaretz and the police describe leaflets at several locations; the group describes a city-wide operation requiring dozens of people on the ground overnight. A QR code on a printed sheet is cheap; the claimed manpower is not, and no Israeli authority has confirmed it. The pattern is consistent with what an independent analyst newsletter reports Check Point counting over 1–22 October: 87 incidents against Israel, mostly DDoS and defacement, including a Handala countdown and three unverified breach claims, with the firm’s own verdict that “claims are outpacing proof.” The Files has not retrieved Check Point’s original publication and relays that figure as second-hand. The same newsletter records Handala claiming it left bouquets at polling stations and posted unverified video purporting to show IDF base interiors.

Assessment: Physical-world theatre marketed as cyber capability either precedes an operation or substitutes for one, and the distinction is resolvable. Watch whether the Israel National Cyber Directorate — which on 2 November told retail chains to inspect refrigeration and remote-access systems, a week before France attributed that campaign to the IRGC — issues parallel advisories to water utilities and the Israel Electric Corporation. Watch, too, whether police name suspects: leaflets delivered by people inside Israel is an operational finding; leaflets delivered by a courier who did not know what he was carrying is a marketing finding. Until then, treat the operative count as unevidenced, and note that the Fars rendering is the group’s own press release carried by a state-aligned outlet.