Handala Uses WhatsApp to Threaten US Troops in Bahrain
Summary
Handala reportedly sent US troops in Bahrain WhatsApp messages threatening drone and missile attacks. The group also claimed it published personal information on 2,379 US Marines stationed in the Persian Gulf.
Key points
- Messages signed Handala reportedly reached US troops in Bahrain via WhatsApp, claiming they were under surveillance and threatening drone and missile attacks.
- Handala claimed on its Telegram channel that it published personal information on 2,379 US Marines stationed in the Persian Gulf.
- The Navy had warned service members earlier in the month about Iran-linked influence campaigns, according to the article.
- The US linked Handala to Iran’s Ministry of Intelligence and Security in March, following a disruptive attack on Stryker.
- Handala claimed it wiped more than 200,000 systems in the Stryker attack using compromised administrator credentials in Microsoft Intune.
- The article says the US confirmed a separate incident involving FBI Director Kash Patel’s personal Gmail account and offered a $10 million reward for information on Handala members.
Article Details
- Event Type
- Influence campaign targeting US troops in Bahrain through threatening WhatsApp messages.
- Impact
- The messages claimed that service members were under surveillance and would soon be attacked. Handala also boasted that it had published personal information of 2,379 US Marine Corps members stationed in the Persian Gulf; the article reports this as the group's claim.
Threat Actors
Banished KittenListed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.DuneListed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.HandalaThe article identifies Handala as an Iran-linked threat actor responsible for the influence campaign targeting US troops in Bahrain.Homeland JusticeListed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.Red SandstormListed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.Storm-0842Listed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.Void ManticoreListed as another tracking name for Handala, which the article identifies as an Iran-linked threat actor.
Malware
BiBi WiperHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.ChillWipeHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.CoolWipeHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.HamsaHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.HatefHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.
Products
GmailThe group also claimed to have hacked FBI Director Kash Patel’s personal Gmail account.Microsoft IntuneBoasting about the Stryker attack, Handala claimed wiping out over 200,000 systems using compromised administrator credentials in Microsoft Intune.Telegram Bot APIHandala also relies on wipers (BiBi Wiper, CoolWipe, ChillWipe, Hamsa, and Hatef) and leverages the Telegram Bot API for command-and-control (C&C) communication.WhatsAppThe Iran-linked threat actor Handala this week targeted US troops in Bahrain in an influence campaign carried out on WhatsApp.
Countries
BahrainThe Iran-linked threat actor Handala this week targeted US troops in Bahrain in an influence campaign carried out on WhatsApp.IranThe Iran-linked threat actor Handala this week targeted US troops in Bahrain in an influence campaign carried out on WhatsApp.United StatesIn March, the US officially linked Handala to Iran’s Ministry of Intelligence and Security (MOIS), following the disruptive attack on the US-based medical technology giant Stryker.