{"id":1171997,"date":"2025-12-28T11:07:52","date_gmt":"2025-12-28T19:07:52","guid":{"rendered":"https:\/\/theaegisalliance.com\/?p=1171997"},"modified":"2026-10-04T19:55:25","modified_gmt":"2026-10-05T02:55:25","slug":"iranian-hacker-group-claims-they-breached-israeli-pm-netanyahus-chief-of-staffs-phone","status":"publish","type":"post","link":"https:\/\/theaegisalliance.com\/fr\/2025\/12\/28\/iranian-hacker-group-claims-they-breached-israeli-pm-netanyahus-chief-of-staffs-phone\/","title":{"rendered":"Haaretz Called Tzachi Braverman&rsquo;s Contact Dump a Data Leak as Prosecutors Moved to Charge Him Over a Different Secret in the Gaza War"},"content":{"rendered":"<div class=\"epyt-video-wrapper\">\n<div  style=\"display: block; margin: 0px auto;\"  id=\"_ytid_75413\"  width=\"480\" height=\"270\"  data-origwidth=\"480\" data-origheight=\"270\" data-facadesrc=\"https:\/\/www.youtube.com\/embed\/PGqiJ9B6eYA?enablejsapi=1&#038;origin=https:\/\/theaegisalliance.com&#038;autoplay=0&#038;cc_load_policy=0&#038;iv_load_policy=1&#038;loop=0&#038;fs=1&#038;playsinline=0&#038;controls=1&#038;disablekb=0&#038;color=red&#038;cc_lang_pref=&#038;rel=0&#038;autohide=2&#038;theme=dark&#038;\" class=\"__youtube_prefs__ epyt-facade epyt-is-override  no-lazyload\" data-epautoplay=\"1\" ><img decoding=\"async\" data-spai-excluded=\"true\" class=\"epyt-facade-poster skip-lazy\" loading=\"lazy\"  alt=\"Qatar, \u2018Bibigate\u2019 &amp; \u2018Dirty Secrets\u2019: Iran&#039;s Hackers EXPOSE Netanyahu, Break Into Aide\u2019s Phone\"  src=\"https:\/\/i.ytimg.com\/vi\/PGqiJ9B6eYA\/maxresdefault.jpg\"  \/><button class=\"epyt-facade-play\" aria-label=\"Play\"><svg data-no-lazy=\"1\" height=\"100%\" version=\"1.1\" viewBox=\"0 0 68 48\" width=\"100%\"><path class=\"ytp-large-play-button-bg\" d=\"M66.52,7.74c-0.78-2.93-2.49-5.41-5.42-6.19C55.79,.13,34,0,34,0S12.21,.13,6.9,1.55 C3.97,2.33,2.27,4.81,1.48,7.74C0.06,13.05,0,24,0,24s0.06,10.95,1.48,16.26c0.78,2.93,2.49,5.41,5.42,6.19 C12.21,47.87,34,48,34,48s21.79-0.13,27.1-1.55c2.93-0.78,4.64-3.26,5.42-6.19C67.94,34.95,68,24,68,24S67.94,13.05,66.52,7.74z\" fill=\"#f00\"><\/path><path d=\"M 45,24 27,14 27,34\" fill=\"#fff\"><\/path><\/svg><\/button><\/div>\n<\/div>\n<p>Handala said it owned Tzachi Braverman&rsquo;s phone. What it put on the internet on December 28, 2025, looked like photographs, office paper, and a contact book. Israel&rsquo;s Prime Minister&rsquo;s Office answered with a sentence small enough to drive a truck through: no indications, at that stage, that the mobile itself was compromised, investigation continuing. Weeks later the office told Haaretz something tighter. It appeared to be a data leak, not a phone hack. Those are not the same claim. A backup, a paired laptop, a staffer&rsquo;s cloud, or a synced messaging app can bleed a directory without the handset ever leaving a pocket. Headlines said phone hack. The office said device status unknown-to-clean. The graph of names is the object that matters, and the graph did not stay a December problem.<\/p>\n<p>Braverman was the man who decided who reached Benjamin Netanyahu, and he had just been approved as ambassador-designate to Britain. A book like that is a map of the prime minister&rsquo;s door. The AEGIS Alliance treated the drop as the second product in a campaign that opened with a <a href=\"https:\/\/theaegisalliance.com\/2025\/12\/27\/iranian-hacker-group-issues-cyber-threats-against-netanyahus-flight\/\">poem about the Florida flight<\/a>. This page is about the book, and about the fact that the same gatekeeper later became a criminal defendant in a different leak, one his own government says he tried to shut down.<\/p>\n<h2>What was posted, and what was only promised<\/h2>\n<p>Handala&rsquo;s copy called the dump \u00ab\u00a0The Gatekeeper&rsquo;s Fall\u00a0\u00bb and told Netanyahu&rsquo;s circle that every layer of security had already failed. It teased 110 pages of contacts on the first night. It claimed instant messages, email, and proof of \u00ab\u00a0vile financial and moral acts,\u00a0\u00bb including extortion and bribery. <a href=\"https:\/\/www.calcalistech.com\/ctechnews\/article\/bjubvorxwg\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Calcalist<\/a> read the first batch and said the files did not substantiate that caption. The visible material looked like a directory, videos of Braverman at events, unclassified notices, and thin correspondence. The group also said it had emailed the archive to former prime minister Naftali Bennett, who brought in security officials and told his circle not to make political use of \u00ab\u00a0products of the Iranian attack, should they be received.\u00a0\u00bb<\/p>\n<p><a href=\"https:\/\/www.jpost.com\/israel-news\/article-881550\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">The Jerusalem Post<\/a> carried the denial the same day. i24, Israel Hayom, and Ynet carried the screenshots. None of them is a laboratory. The public still does not have a letter that says this file came off this IMEI at this hour. What the public does have is Haaretz&rsquo;s January reconstruction: roughly 2,400 contacts from Braverman&rsquo;s book, plus lists tied to Bennett and to former justice minister Ayelet Shaked, including security officials and foreign names. Dozens of the Braverman entries were saved with notes that marked sensitive roles. Haaretz left open whether Handala had touched the devices or had reached cloud copies of WhatsApp and Telegram, which store contacts, images, and video without the phone itself being in an adversary&rsquo;s hand. That is the distinction the Prime Minister&rsquo;s Office was reaching for, and it does not make the numbers harmless.<\/p>\n<div class=\"embed-x\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Iranian hacker group Handala threatens to release &quot;confidential information about Hamas, Iran, and behind-the-scenes decisions&quot; it claims to have obtained from former Israeli justice minister&#39;s phone<a href=\"https:\/\/t.co\/ZesAJywPzn\">https:\/\/t.co\/ZesAJywPzn<\/a><\/p>\n<p>&mdash; Haaretz.com (@haaretzcom) <a href=\"https:\/\/x.com\/haaretzcom\/status\/2007840695340380442?ref_src=twsrc%5Etfw\">January 4, 2026<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<h2>A graph is worth more than a trophy phone<\/h2>\n<p>Intelligence work is often just graph paper. Who can reach the prime minister. Whose personal line sits one hop off that desk. Which foreign official, donor, or journalist is saved next to a security chief. A dump that names those edges stays useful after the screenshots stop circulating. It is useful to an adversary building a target list. It is useful to a criminal writing a spear-phish. It is useful to anyone who wants to know the shape of a government that does not publish its own org chart.<\/p>\n<p>The Braverman claim did not arrive alone. On December 18 Handala said it had Bennett&rsquo;s phone and published chats plus a long contact list. Bennett&rsquo;s answer was specific: Telegram, not the handset. On January 3, 2026, the group posted about 60 photos and videos it attributed to Shaked. On January 8 it claimed surveillance of a senior Mossad officer. On February 25 it said it had released medical records of more than 10,000 Clalit patients. In July, The Times of Israel reported a trove the group attributed to former military chief Herzi Halevi, including family photographs and identity cards. Each post is its own authentication problem. Together they are a method. Announce a brand. Drip enough true-looking material to make the next official wonder which of his lines is already gone. The International Institute for Counter-Terrorism called Bibi Gate a mask for Iranian psychological warfare. That reading fits a real leak. A service that wants panic does not need every transistor in a chief of staff&rsquo;s pocket. It needs enough true numbers to make the denial sound small.<\/p>\n<h2>The other leak, the one prosecutors say he tried to kill<\/h2>\n<p>The phone book is not the only secret that left Braverman&rsquo;s orbit. On May 26, 2026, Attorney General Gali Baharav-Miara moved to charge him, pending a hearing, with fraud, breach of trust, and obstruction of justice. <a href=\"https:\/\/www.timesofisrael.com\/liveblog_entry\/ag-set-to-indict-pms-chief-of-staff-for-obstruction-of-justice-and-fraud-and-breach-of-trust-pending-hearing\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">The Times of Israel<\/a> and <a href=\"https:\/\/www.jpost.com\/israel-news\/politics-and-diplomacy\/article-897326\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">The Jerusalem Post<\/a> tied the suspicion to an October 2024 midnight meeting in a car at the Kirya, the military headquarters in Tel Aviv. Prosecutors say Braverman had learned of a covert investigation into a top-secret intelligence item passed to the German tabloid Bild, met media adviser Eli Feldstein, read names off a paper, and said that if the probe was \u00ab\u00a0connected to us\u00a0\u00bb he could shut it down. Feldstein was later indicted over the Bild leak. Braverman&rsquo;s lawyers say the case rests on a dishonest witness who gave contradictory versions. Braverman denies wrongdoing. A hearing is not a conviction.<\/p>\n<p>The two leaks should not be mashed together. Handala is an Iran-tied crew dumping a directory and daring Israel to call it fake. The Bild case is an Israeli prosecution about classified material allegedly used, during the war in Gaza, to argue that Hamas rather than Netanyahu was blocking a hostage deal. Jewish News reported that Braverman was arrested in January 2026 in that probe. By May, Israeli coverage described him both as chief of staff and as the former chief of staff still designated for London. The point of printing them on one page is not that the hackers and the prosecutors share a file. It is that the office which lost a contact book was already an office accused of treating secrets as a political tool in a war that legal scholars, UN experts, and medical charities have called a genocide.<\/p>\n<div class=\"embed-x\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Tzachi Braverman, the chief of staff at the Prime Minister&#39;s Office and designated ambassador to the UK, will be summoned for a pre-indictment hearing, the State Attorney&#39;s Office announced. <br \/>\u270d\ufe0f <a href=\"https:\/\/x.com\/sarahbennun?ref_src=twsrc%5Etfw\">@sarahbennun<\/a><a href=\"https:\/\/t.co\/AAEAV8LNI1\">https:\/\/t.co\/AAEAV8LNI1<\/a><\/p>\n<p>&mdash; The Jerusalem Post (@Jerusalem_Post) <a href=\"https:\/\/x.com\/Jerusalem_Post\/status\/2059195762748149887?ref_src=twsrc%5Etfw\">May 26, 2026<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<h2>Why the denial does not retire the graph<\/h2>\n<p>A state fighting that war has killed tens of thousands of Palestinians, pushed international doctors out of Gaza over a staff-list demand, and still has to explain how its gatekeeper&rsquo;s numbers reached an adversary. The AEGIS Alliance has kept that Gaza record in the <a href=\"https:\/\/theaegisalliance.com\/2025\/12\/31\/israel-bans-humanitarian-organizations-orders-several-to-cease-operations-in-gaza-in-early-2026\/\">aid-group ban<\/a> and in the <a href=\"https:\/\/theaegisalliance.com\/2026\/01\/31\/qatar-egypt-and-jordan-condemn-the-ceasefire-violations-in-gaza-committed-by-israel\/\">ceasefire-strike rebuke from Qatar, Egypt, and Jordan<\/a>. A crew that brands itself as a voice for Palestinians does not get a pass on unverified PDFs. A government that runs the bombardment does not get to answer a 2,400-name exposure with the word \u00ab\u00a0indications.\u00a0\u00bb<\/p>\n<p>The correct status line is still the boring one. Claimed. Denied as a handset compromise. Redescribed by the Prime Minister&rsquo;s Office as a data leak. Partially corroborated by a newspaper reconstruction of contact lists. Not closed by a hash. Separately, the same man is facing a pre-indictment hearing over an alleged attempt to smother a classified-leak investigation. Readers who want the technical file can stay with The AEGIS Alliance <a href=\"https:\/\/theaegisalliance.com\/category\/news\/hacker-news\/\">hacker news<\/a> desk. Readers who want the political file can stay with <a href=\"https:\/\/theaegisalliance.com\/category\/news\/international-news\/\">international news<\/a>. The trophy phone was never the story. The graph was. The hearing is the reminder that the graph&rsquo;s owner was already standing in more than one leak.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Handala&rsquo;s December 2025 dump of Tzachi Braverman&rsquo;s contacts was later described by the Prime Minister&rsquo;s Office as a data leak, not a phone hack. In May 2026 prosecutors moved to charge him, pending a hearing, over a separate classified leak.<\/p>\n","protected":false},"author":1,"featured_media":1172078,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,23,21],"tags":[233212,192022,3674,233213,233142,206,233211,52],"class_list":["post-1171997","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacker-news","category-international-news","category-news","tag-bibi","tag-hacker-news","tag-hackers","tag-handala","tag-iran","tag-israel","tag-netanyahu","tag-news"],"jetpack_featured_media_url":"https:\/\/theaegisalliance.com\/wp-content\/uploads\/Iranian-hacker-group-claims-they-breached-Israeli-PM-Netanyahus-chief-of-staffs-phone-1.jpg","_links":{"self":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1171997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/comments?post=1171997"}],"version-history":[{"count":5,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1171997\/revisions"}],"predecessor-version":[{"id":1203139,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1171997\/revisions\/1203139"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/media\/1172078"}],"wp:attachment":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/media?parent=1171997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/categories?post=1171997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/tags?post=1171997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}