Handala Claims Breach of FBI Director Kash Patel’s Email Amid Stryker Wiper Incident
Summary
Handala claimed it breached FBI Director Kash Patel’s personal email; the FBI confirmed targeting and said leaked material was historical. The group also claimed the Stryker wiper attack, which the company says is contained.
Key points
- Handala claimed it breached Patel’s personal email and published historical messages and photos. The FBI confirmed the account was targeted and said the published data contained no government information.
- Security firms assess Handala as a persona linked to Iran’s Ministry of Intelligence and Security (MOIS), also tracked under several other names.
- Check Point reported hundreds of VPN logon and brute-force attempts linked to Handala-associated infrastructure. Reported tactics include compromised VPN accounts, Intune abuse, RDP lateral movement, and wipers deployed through Group Policy scripts.
- Handala claimed the Stryker attack involved deleting company data and wiping employee devices. Stryker says the incident is contained and confined to its internal Microsoft environment; it said a malicious file used in the attack could not spread across the network.
- Microsoft and CISA issued guidance recommending least privilege, phishing-resistant MFA, and multi-admin approval for sensitive Intune changes.
- The U.S. seized four domains linked to MOIS operations and is offering a $10 million reward for information on Handala members.
Article Details
- Event Type
- Reported breach and leak of FBI Director Kash Patel’s personal email, alongside a destructive wiper attack on Stryker attributed to Handala Hack.
- Impact
- The Patel leak included historical emails, photos, and other documents; the FBI said the published data was historical and contained no government information, and that it had taken steps to mitigate potential risks. Handala Hack claimed responsibility for deleting company data and wiping thousands of Stryker employee devices. Stryker said the incident was contained to its internal Microsoft environment and that it had removed the unauthorized party and dismantled persistence mechanisms.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | The U.S. Department of Justice said this seized domain was operated by MOIS and used for psychological operations, including claiming hacking activity and posting stolen data. |
| DOMAIN | handala-redwanted[.]to | The U.S. Department of Justice said this seized domain was operated by MOIS and used for psychological operations, including claiming hacking activity and posting stolen data. |
| DOMAIN | handala-team[.]to | Handala Hack reportedly resurfaced on this clearnet domain after the seizure of its other domains. |
| DOMAIN | justicehomeland[.]org | The U.S. Department of Justice said this seized domain was operated by MOIS and used for psychological operations, including claiming hacking activity and posting stolen data. |
| DOMAIN | karmabelow80[.]org | The U.S. Department of Justice said this seized domain was operated by MOIS and used for psychological operations, including claiming hacking activity and posting stolen data. |
handala_team@outlook[.]com | An email address linked to Handala was alleged to have been used to send death threats to Iranian dissidents and journalists. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolHandala-associated attacks reportedly use RDP for lateral movement.T1078 · Valid AccountsThe article describes initial access using compromised VPN credentials and credentials associated with Microsoft infrastructure.T1102 · Web ServiceThe FBI said MOIS cyber actors used Telegram as command-and-control infrastructure for malware.T1110 · Brute ForceCheck Point reported hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure.T1133 · External Remote ServicesHandala-associated activity reportedly uses compromised VPN accounts for initial access.T1485 · Data DestructionHandala claimed a destructive attack on Stryker involving deletion of company data and wiping employee devices.T1566 · PhishingPhishing was identified as a likely vector for recent destructive operations attributed to Handala Hack.
People
Kash PatelThe FBI director whose personal email account was reportedly breached and whose historical emails, photos, and other documents were published.Kathryn RainesFlashpoint cyber threat intelligence team lead quoted on the destructive and disruptive activity attributed to groups including Handala.
Threat Actors
Banished KittenThe cybersecurity community tracks Handala Hack under this name; the article presents it as a moniker for the Handala Hack persona.Cobalt MystiqueThe cybersecurity community tracks Handala Hack under this name; the article presents it as a moniker for the Handala Hack persona.FatimionFlashpoint described Fatimion, alongside Handala, as targeting private-sector organizations with attacks designed to erase data and disrupt services.HandalaThe group claimed responsibility for the Stryker wiper attack and said it breached Kash Patel’s personal email. It is assessed as a pro-Iranian, pro-Palestinian persona adopted by Iran’s MOIS; attribution of specific activity is reported or assessed in the article.Homeland JusticeThe article describes Homeland Justice as another persona operated by the MOIS-affiliated adversary and says it has targeted Albanian entities since mid-2022.KarmaThe article describes Karma as a persona linked to the MOIS-affiliated adversary and says it was likely completely replaced by Handala Hack since late 2023.MOISThe article assesses Handala Hack as a persona adopted by Iran’s Ministry of Intelligence and Security and says MOIS cyber actors used Telegram C2 to deliver malware targeting dissidents, journalists, and opposition groups.MuddyWaterThe article reports that MuddyWater used the Tsundere botnet and Fakeset downloader as part of MOIS-linked actors’ engagement with the cybercrime ecosystem.Nasir SecurityResecurity reportedly observed this group targeting the Middle East energy sector and supply-chain vendors; its attacks were described as likely carried out by cyber-mercenaries or individuals hired or sponsored by Iran or its proxies.Red SandstormThe cybersecurity community tracks Handala Hack under this name; the article presents it as a moniker for the Handala Hack persona.Void ManticoreThe cybersecurity community tracks Handala Hack under this name; the article presents it as a moniker for the Handala Hack persona.
Malware
CastleLoaderThis includes Handala’s integration of Rhadamanthys stealer into its operations and MuddyWater’s use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader.DinDoorThis includes Handala’s integration of Rhadamanthys stealer into its operations and MuddyWater’s use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader.FakesetThis includes Handala’s integration of Rhadamanthys stealer into its operations and MuddyWater’s use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader.Handala PowerShell Wiperand initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.Handala Wiperfor lateral movement and initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.RhadamanthysThis includes Handala’s integration of Rhadamanthys stealer into its operations and MuddyWater’s use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader.Tsundere BotnetThis includes Handala’s integration of Rhadamanthys stealer into its operations and MuddyWater’s use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader.
Vendors
Microsoftand known for destructive wiper operations including the Stryker attack, leverages compromised VPNs, Microsoft Intune abuse, RDP lateral movement, Telegram C2, and wiper families to carry out disruptive campaigns.StrykerThe group, assessed as tied to Iran’s MOIS and known for destructive wiper operations including the Stryker attack, leverages compromised VPNs, Microsoft Intune abuse, RDP lateral movement, Telegram C2, and wiper
Products
KeePassusing a Telegram bot by masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp.Microsoft Intuneand known for destructive wiper operations including the Stryker attack, leverages compromised VPNs, Microsoft Intune abuse, RDP lateral movement, Telegram C2, and wiper families to carry out disruptive campaigns.Microsoft Windowsseized multiple Handala-linked domains, offered a $10 million reward, and Microsoft/CISA have issued guidance to harden Intune and Windows defenses.Pictoryaccess using a Telegram bot by masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp.Telegramincluding the Stryker attack, leverages compromised VPNs, Microsoft Intune abuse, RDP lateral movement, Telegram C2, and wiper families to carry out disruptive campaigns.VeraCryptAlso used are legitimate disk encryption utilities like VeraCrypt to complicate recovery efforts.WhatsAppby masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp.ZoomRelated malware artifacts found on compromised devices have revealed added capabilities to record audio and screen while a Zoom session was active.
Countries
IranIran-linked threat actors operating under the Handala Hack persona breached FBI director Kash Patel’s personal email and published historical photos and documents online.IsraelThe development comes against the backdrop of the U.S.-Israel-Iran conflict, prompting Iran to go on a retaliatory cyber offensive against Western targets.United StatesThe U.S. seized multiple Handala-linked domains, offered a $10 million reward, and Microsoft/CISA have issued guidance to harden Intune and Windows defenses.
Industries
EnergyIn recent weeks, a relatively new cybercriminal group called Nasir Security has been observed targeting the energy sector in the Middle East.GovernmentThe agency also said the published data was “historical in nature and involves no government information.” The leak includes emails from â2010 and 2019 allegedly sent by Patel.Healthcaretargeting critical suppliers and logistics providers can have cascading impacts across the entire healthcare ecosystem.