DomainTools Assesses MrHex as Handala-Aligned, Cites Evidence of Industrial HMI Access
Summary
DomainTools assesses MrHex as an Iran-aligned hack-and-leak network connected to Handala. Shared infrastructure and actor promotion link its data sites; video supports access to an industrial HMI, but claims of physical damage remain unverified.
Key points
- DomainTools assesses MrHex, MrDarkRoot, @Mr8ex, and Darku3er as connected campaign identities, while noting that the evidence does not prove common control or direct Iranian government control.
- Shared infrastructure, overlapping victim material, and actor promotion support the assessment that JokerData, BlackLeaks, and MrHex sites belong to a coordinated ecosystem; shared nameservers alone are weak evidence.
- The MrHex archive includes previously leaked email dumps attributed to Handala and CyberAv3ngers. Other purported FBI/CIA material is largely thumbnails and names, and its origin and authenticity remain undetermined.
- A September 18, 2026 screen recording provides credible evidence of interactive access to a Windows-based industrial HMI. Interface details and batch records are consistent with a petroleum loading environment, but do not demonstrate destructive manipulation.
- MrHex’s claims of attacks on U.S. industrial facilities, including contamination, an explosion, and disabled pumps, remain unverified. The article reports no independent confirmation of those impacts or evidence of altered control logic or physical damage.
- MrDarkRoot advertised purported government and company datasets for sale, but the data had not been downloaded and investigated, so its origins and significance were unknown.
- The MrHex sites were offline as of October 20, 2026; the article says the domains had not been seized.
Article Details
- Attack Vectors
- The campaign redistributes allegedly stolen or previously leaked datasets through its websites, criminal-forum posts, and Telegram channels; the origin of many datasets is unverified.
- A September 18 recording provides credible evidence of interactive access to a Windows-based industrial HMI, but does not show how access was obtained or demonstrate control manipulation.
- Defensive Notes
- Treat claims of pipeline contamination, an explosion, disabled pumps, and broader destructive OT impact as unverified; the available recording does not establish physical damage or altered industrial controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | blackleaks[.]sbs | Campaign bulk-distribution site for leaked documents and email archives. |
| DOMAIN | jokerdata[.]org | Campaign domain used to advertise and sell access to allegedly compromised datasets. |
| DOMAIN | jokerdata[.]shop | Campaign domain used to advertise and distribute allegedly compromised data. |
| DOMAIN | mrhex[.]sbs | Campaign leak site used to publish and present allegedly stolen data in searchable collections. |
| IPV4 | 51[.]79[.]96[.]115 | Reported hosting IP for jokerdata[.]org, a campaign site used to advertise and sell allegedly compromised datasets. |
| URL | hxxps[:]//t[.]me/Darku3er | Telegram contact linked from campaign sales posts for buyer communications and transactions involving advertised datasets. |
MITRE ATT&CK
Threat Actors
@Mr8exThe article identifies this as a confirmed alternate handle for the MrHex persona. A recording supports access to an industrial HMI, but does not establish the claimed destructive impact.CyberAv3ngersThe article attributes earlier hacks behind some verified email-spool dumps to CyberAv3ngers, whose material was later republished in the MrHex campaign.Darku3erCampaign-linked Telegram contact directed to prospective dataset buyers; the article says it is unclear whether this is a separate operator or an account controlled by the same individual or group.HandalaMrDarkRoot claimed Handala provided information on Israeli and U.S. targets for redistribution. The article describes cooperation as a credible working assessment, not proof of common control.MrDarkRootMarketplace-facing campaign identity that advertised allegedly hacked datasets for sale and claimed to have accessed U.S. government and company data; many claims remain independently unverified.MrHexPublic-facing identity for an Iran-aligned hack-and-leak campaign that published allegedly stolen data and claimed industrial-system attacks; the article assesses the Handala relationship as credible but not proof of common control.
Vendors
CloudflareThe domains jokerdata[.]shop, blackleaks[.]sbs, and mrhex[.]sbs were all observed using the same Cloudflare nameserver pair; martha.ns.cloudflare.com and otto.ns.cloudflare.com.OVHJokerdata[.]org was hosted through OVH at 51.79.96.115. However, its Name Server and SOA records referenced ParsVDS, with Iranian hosting company infrastructure tying them directly to Iran. ParsPackby AS202269, BitCommand LLC. That same infrastructure is used by Iranian .ir domains configured with ParsPack nameservers. Other AS202269 prefixes are directly associated with ParsPack and Iranian network resourcesParsVDSJokerdata[.]org was hosted through OVH at 51.79.96.115. However, its Name Server and SOA records referenced ParsVDS, with Iranian hosting company infrastructure tying them directly to Iran.
Products
Countries
Irandata brokerage into politically motivated disclosure activity and cyber-physical operations on behalf of Iran.Israelnews reporting has described MrHex as an Iranian cyber actor, and their targets have featured entities in Israel and the U.S., Kurdish opposition entities, and security organizations deemed enemies of Iran. The actorsUnited Stateshas described MrHex as an Iranian cyber actor, and their targets have featured entities in Israel and the U.S., Kurdish opposition entities, and security organizations deemed enemies of Iran. The actors have also
Industries
EducationSeparate monitoring also found MrDarkRoot advertising numerous alleged education-sector datasets during August 2026, reinforcing the assessment that the account serves as a data-brokerage and sales interface, althoughEnergyagainst three critical infrastructure sites in the United States. These attacks, which targeted energy network security and industrial facilities, have caused significant damage. According to availableGovernmentto appear. On DarkForums, MrDarkZRoot began a new campaign of data sales of American companies and government data they claimed they had hacked. In these posts, they created new Telegram channels for sales andLaw enforcementdatabases, publishing records purportedly associated with U.S. and Israeli military personnel, law enforcement, intelligence agencies, and political figures.