FBI Seizes Four Domains Linked to Iran’s MOIS and Handala Operations
Summary
The DOJ seized four domains that the FBI says were used by Iran’s MOIS, including Handala, to publish stolen data. Court filings describe a Handala-claimed Stryker wiper attack that disrupted hospital communications; the U.S. is offering a $10 million reward.
Key points
- The DOJ seized four domains that the FBI says were used by Iran’s MOIS in operations dating back to 2022.
- The FBI says the domains hosted data allegedly stolen from Albania, Iranian dissidents, Israeli officials and U.S. companies.
- Handala claimed responsibility for an attack on Stryker. Prosecutors say attackers used Microsoft Intune’s device-wipe feature to erase data on more than 200,000 devices.
- Prosecutors said the Stryker disruption affected Maryland hospitals; some temporarily suspended connections, and clinicians were instructed to use radio and verbal communication.
- The FBI linked the domains to 2022 attacks on Albania. CISA later said Iranian actors had access to Albanian networks for over a year and stole government email.
- The State Department offered a $10 million reward for information about people involved in creating the websites or participating in the cyberattacks.
Article Details
- Event Type
- U.S. law enforcement seizure of four domains allegedly used by Iran’s Ministry of Intelligence and Security (MOIS) and Handala for cyber operations and publishing stolen information.
- Impact
- The DOJ seized four domains linked by the FBI to MOIS operations dating back to 2022. Handala claimed responsibility for an attack on Stryker that used Microsoft Intune’s device-wipe feature to erase data on more than 200,000 devices. Prosecutors said the disruption affected hospital communications in Maryland, with some hospitals temporarily suspending connections to Stryker and clinicians relying on radio and verbal coordination. The FBI also said the domains hosted information stolen from Albania, Iranian dissidents, Israeli officials, U.S. companies, and members of the Sanzer community. The State Department offered a $10 million reward for information about those involved.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | Domain seized by the DOJ and allegedly used in MOIS operations to host stolen information and propaganda. |
| DOMAIN | handala-redwanted[.]to | Domain seized by the DOJ and allegedly used in MOIS operations to host stolen information and propaganda. |
| DOMAIN | justicehomeland[.]org | Domain seized by the DOJ and allegedly used in MOIS operations to host stolen information and propaganda. |
| DOMAIN | karmabelow80[.]org | Domain seized by the DOJ and allegedly used in MOIS operations to host stolen information and propaganda. |
MITRE ATT&CK
People
Threat Actors
HandalaThe article describes Handala as an MOIS-linked name used in cyber operations. Handala claimed responsibility for the Stryker attack and posted information it said was stolen.Ministry of Intelligence and Security (MOIS)The FBI and DOJ attributed operations involving the seized domains to Iran’s MOIS, which the article says operated under online monikers including Handala.
Vendors
MicrosoftOne Handala-linked attack leveraged Microsoft Intune’s device-wipe feature to erase data on over 200,000 Stryker devices, disrupting hospital communications and prompting a $10 million U.S.StrykerOne Handala-linked attack leveraged Microsoft Intune’s device-wipe feature to erase data on over 200,000 Stryker devices, disrupting hospital communications and prompting a $10 million U.S.
Products
Countries
AlbaniaAuthorities linked Handala to earlier hacks of Albania and theft from the Sanzer community and offered $10 million for information on the perpetrators.IndiaThe hackers used a native functionality within Intune – the device wipe feature — to destroy all company data on more than 200,000 devices across Stryker’s employee base in the U.S., Ireland, India and other countries.IranThe FBI and Justice Department say Iran’s Ministry of Intelligence and Security (MOIS), operating under aliases including “Handala,” used four seized domains to publish data stolen from governments, dissidents, andIrelandThe hackers used a native functionality within Intune – the device wipe feature — to destroy all company data on more than 200,000 devices across Stryker’s employee base in the U.S., Ireland, India and other countries.IsraelFollowing the onset of kinetic hostilities between the U.S., Israel and Iran, Handala began posting the addresses of IDF officials and sending them threatening emails.United StatesOne Handala-linked attack leveraged Microsoft Intune’s device-wipe feature to erase data on over 200,000 Stryker devices, disrupting hospital communications and prompting a $10 million U.S.