Home/News/CSIS Flags India’s Covert Influence Tactics, Warns of Iranian-Linked Handala Hack Group
CSIS Flags India’s Covert Influence Tactics, Warns of Iranian-Linked Handala Hack Group
Jagdeep Singh
Author
Jagdeep Singh
Category
Canada
Read Time
6 min
Date
May 1, 2026
Share

CSIS Flags India’s Covert Influence Tactics, Warns of Iranian-Linked Handala Hack Group

May 1, 2026
By: Jagdeep Singh
Canada
6 min read

CSIS Flags India’s Covert Influence Tactics, Warns of Iranian-Linked Handala Hack Group

The annual report of Canadian Security and Intelligence Service (CSIS) mentioned that India has cultivated covert relationships with Canadian politicians, journalists, and members of the Indo-Canadian community, to exert its influence and advance its interests. This has included transnational repression (TNR) activities, such as surveillance and other coercive tactics meant to suppress criticism of the Government of India and create fear in the community. Given the presence in Canada of supporters of the Khalistan separatist movement, Canada must remain vigilant regarding potential TNR activities. India acts to counter perceived threats to its domestic stability, including Khalistan separatism. In Canada, advocacy for Khalistan separatism is lawful political activity. 

Iran remains an aggressive perpetrator of TNR. Following the interruption of several Iranian plots in 2025, Canada and 13 other countries issued a joint communiqué in July 2025 condemning “the attempts of Iranian intelligence services to kill, kidnap, and harass people in Europe and North America in clear violation of our sovereignty.” For example, in July 2025, alleged “hacktivist” group “Handala Hack Team” claimed to have hacked the “systems, servers, and communication infrastructure” of Iran International, a Farsilanguage satellite television channel with English, Arabic, and Farsi online news operations based in London, United Kingdom (UK), and Washington, D.C. Iran International maintains a highly critical reporting line vis-à-vis the Iranian regime, and several online security and threat intelligence firms have linked the Handala Hack Team to the Iranian Intelligence Services. 

The Handala Hack Team subsequently doxed* several Iran International linked journalists, including a Canadian resident. The Canadian’s photos, provincial driver’s license, permanent resident card, and Iranian passport details were released on the internet and social media platforms. The hacktivist group reproached the Canadian for, among other things, their promotion of 2SLGBTQIA+ issues in Iran. Within days of being doxed, the Canadian resident began receiving hundreds of violent threats, and their family in Iran was harassed by the authorities. The objective of this harassment—whether in Canada or elsewhere—is to silence these journalists and compel them to stop working for a media outlet that is highly critical of the Government of Iran. CSIS worked with domestic and foreign partners to respond to this incident. On September 12, 2025, the members of the G7 Rapid Response Mechanism and associate members (Australia, the Netherlands, New Zealand, and Sweden) issued another communiqué drawing attention to and condemning Iranian TNR activities, including Iran’s lethal plotting in Europe and North America. CSIS assesses that these foreign actors will continue to use proxies, such as individuals involved with transnational organized crime networks, to target perceived enemies living in foreign countries, including Canada. To address this evolving threat landscape, CSIS is adapting its tradecraft and strengthening its investigative efforts in relation to TNR conducted by these foreign actors. CSIS will work with its counterparts directly to address these concerns. 

Published: May 1, 2026Updated: May 5, 2026
Share:
shape
shape
4.8★ Rating • 50K+ Downloads

Download Our Mobile App

Stay connected with the latest news, podcasts, and updates. Get real-time notifications and enjoy seamless content on the go.

Real-time Updates
Offline Reading
Push Notifications
Mobile App Download