On November 15, 2025, the cyber group known as “Banished Kitten” or “Handala” affiliated with the Ministry of Intelligence and Security of Iran (MOIS), inadvertently disclosed confidential access to the Suvarnabhumi Airport in Bangkok, Thailand, whilst attempting to breach the security of Israel’s Ben Gurion International Airport.
The Handala Group, operating under MOIS’s Counter Terrorism Division, is led by Seyed Yahya Hosseini Panjajki (also known as Seyed Yahya Hamidi) Deputy of Internal Security at MOIS. In a statement posted by the group on the 15 November, the group claimed that they had compromised Israeli security services, stating, “Smile for the camera – Handala is watching” and “Our presence defies your imagination. Handala is not just a name; it’s a shadow, a watchful gaze in places you never expect, even at the exit cameras of your airport gates.”
However, a thorough analysis of the posted images revealed that the location in the pictures was not Ben Gurion International Airport in Tel Aviv, but in fact Suvarnabhumi Airport in Bangkok, Thailand. As you can see in the images below, it is clear that the location in the photo is not Ben Gurion Airport but Suvarnabhumi Airport. The photos clearly shows the ceiling design, immigration hall and elevators of Suvarnabhumi Airport as well as travellers in the passport control area.
This incident marks the first time that Handala has publicly disclosed accessing critical infrastructure outside of Israel. The breach highlights MOIS’s ability to access and control various systems at Suvarnabhumi Airport, including:
- AI-powered facial recognition technology
- License plate tracking
- CCTV systems across the airport
The leaking of this access shows that MOIS has the ability to track peoples’ movements, keep travellers under surveillance and to identify travellers transiting through one of the busiest transit points in Asia. This incident shows the risks of cyber attacks on critical infrastructure and highlights the importance of protecting security systems.
