State Department Offers $10M Reward for Iranian Hacker Tips
In brief
- State Department posted $10M bounty targeting Iranian hacking groups Handala and Parsian Afzar Rayan Borna
- Both groups linked to Iranian state interests including IRGC and Ministry of Intelligence and Security
- Bounty incentivizes individual defection from adversary cyber operations
Targeting Known Adversaries
Handala has publicly claimed responsibility for cyber intrusions targeting entities including the FBI as recently as 2026. The specificity of naming these groups—rather than issuing a broad call for information on "Iranian hackers"—signals a calculated shift in US cyber strategy. The targeting suggests the State Department has enough intelligence to name names but lacks the operational capacity to act unilaterally.
The Rewards for Justice program allows tipsters to submit information through anonymous channels, including Tor-based reporting systems. This anonymity is critical for sources operating in hostile jurisdictions or embedded within target organizations. In 2025, a similar $10 million reward was issued for hackers connected to a group known as CyberAv3ngers. The pattern suggests the State Department is scaling financial incentives as a primary cyber deterrent.
A Program Evolving Beyond Counterterrorism
The Rewards for Justice program has been in operation since 1984, originally focused on counterterrorism. Its expansion into cyber threats reflects how much the threat landscape has shifted. Historically, the program has paid out over $250 million since its inception, though the vast majority of those payments were tied to counterterrorism rather than cyber operations.
The current reward announcement was issued and reissued around March 27-30, 2026, following FBI operations that disrupted some of these networks. The timing suggests coordination between law enforcement takedowns and financial incentives designed to accelerate defections.
The Logic of Defection
"A $10 million bounty operates on a different logic: it creates individual incentives for defection." The strategy acknowledges a hard truth: previous cyber bounties have led to identifications but not always arrests, given the difficulty of extraditing suspects from countries like Iran, Russia, or North Korea. Money can succeed where extradition treaties fail. It targets the weakest link—the individual operator who can be convinced to flip—rather than betting on conventional law enforcement machinery.
