State proxy hacktivism, like Iran’s Handala group, was on the rise in 2025, with strong indications that in 2026, there will be attacks focused on damaging actual infrastructure rather than only hacking official state websites, a new report by KELA Group warned on Wednesday.
According to the report, state-sponsored actors are using autonomous agents powered by artificial intelligence to run up to 90% of their attacks, with most of them coming from China, North Korea, Russia, and Iran.
It also warned that the main hacktivist groups are located in the focal geopolitical conflicts, with the main current areas of interest being Ukraine-Russia, Israel-Iran, US-China, and the Korean conflict.
The report warns that over the last year, most attacks focused on disrupting official government websites, and there are indications that future attacks could target power grids, water treatment plants, or manufacturing sites.
It also said that disaster recovery units must prepare for “total loss” scenarios, in which critical information would be stolen by hacker groups with the goal of causing physical-world damage to the victims.
