Handala Group's Ransomware Attack on Israel's Ma’agan Michael Kibbutz

Incident Date:

June 15, 2024

World map



Handala Group's Ransomware Attack on Israel's Ma’agan Michael Kibbutz


Ma’agan Michael Kibbutz




Ma'agan Michael, Israel

, Israel

First Reported

June 15, 2024

Ransomware Attack on Ma’agan Michael Kibbutz by Handala Group

Overview of Ma’agan Michael Kibbutz

Ma’agan Michael Kibbutz, located near the Mediterranean coast in Israel, is one of the largest and most financially independent kibbutzim in the country. Founded in 1949, it operates on principles of communal living and shared resources. The kibbutz is involved in agriculture, industry, and tourism. Its agricultural activities include crop cultivation and extensive fish farming. The kibbutz is also home to Plasson Ltd., a globally recognized manufacturer of plastic products, contributing significantly to its financial stability.

Details of the Ransomware Attack

The ransomware group Handala has claimed responsibility for a cyberattack on Ma’agan Michael Kibbutz. The group announced the attack on their dark web leak site, stating that they have exfiltrated 22GB of data and sent over 5,000 warning SMS messages. The ransom message criticized the kibbutz and Israel, highlighting the group's political stance.

About Handala Ransomware Group

Handala is a cybercriminal organization known for its pro-Palestinian stance and history of targeting Israeli institutions. The group employs sophisticated phishing campaigns and multi-stage malware loading processes to infiltrate systems. Their attacks have previously targeted Israeli defense systems and other critical infrastructure, causing significant disruptions.

Potential Vulnerabilities

Ma’agan Michael Kibbutz's diverse economic activities and reliance on modern technologies in agriculture and industry may have made it a target for cyberattacks. The kibbutz's prominence and financial independence could have attracted Handala, aiming to make a political statement while causing economic damage.

Penetration Methods

Handala likely used sophisticated phishing campaigns to gain initial access to the kibbutz's systems. The group's malware, known for its obfuscation techniques, could have bypassed traditional security measures, allowing them to exfiltrate data and disrupt operations.

Impact and Consequences

The attack on Ma’agan Michael Kibbutz underscores the ongoing threat posed by ransomware groups like Handala. The exfiltration of sensitive data and the disruption of operations highlight the need for robust cybersecurity measures to protect against such sophisticated threats.


Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.