US Links Handala to Iran’s MOIS as Authorities Seize Four Websites
Summary
The U.S. Justice Department says Iran’s MOIS used four websites linked to Handala for psychological operations and seized them, formally linking the group to the ministry. Handala’s X account was also suspended.
Key points
- The U.S. government officially linked Handala to Iran’s Ministry of Intelligence and Security (MOIS).
- The Justice Department seized Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to.
- The Justice Department said MOIS used the sites for psychological operations, including claiming hacking activity and posting sensitive data allegedly stolen in those hacks.
- Handala’s X account was suspended in recent days.
- The article says Handala’s best-known attack targeted Stryker, disrupting the medical technology company after thousands of systems were wiped.
Article Details
- Event Type
- US government attribution of Handala to Iran’s Ministry of Intelligence and Security (MOIS), accompanied by the seizure of four websites used by the group.
- Impact
- Authorities seized four websites used for psychological operations, including to claim credit for hacking activity and post data allegedly stolen in attacks. Handala has allegedly carried out attacks involving data theft and deletion; its attack on Stryker reportedly disrupted thousands of systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | Domain seized by authorities; the Justice Department said the websites were used by MOIS for psychological operations. |
| DOMAIN | handala-redwanted[.]to | Domain seized by authorities; the Justice Department said the websites were used by MOIS for psychological operations. |
| DOMAIN | justicehomeland[.]org | Domain seized by authorities; the Justice Department said the websites were used by MOIS for psychological operations. |
| DOMAIN | karmabelow80[.]org | Domain seized by authorities; the Justice Department said the websites were used by MOIS for psychological operations. |
MITRE ATT&CK
Threat Actors
HandalaThe US government officially linked Handala to Iran’s government and MOIS. The article reports allegations that the group carried out attacks involving system wiping, data theft, and other activity.Void ManticoreThe cybersecurity community reportedly regards Handala as a cover for Void Manticore, described as an Iranian state-sponsored threat actor believed to operate under MOIS direction.
Countries
IranHandala has been on the radar of cybersecurity firms for years, but it gained widespread attention in recent days after ramping up its activity following the start of the US-Israel-Iran conflict.IsraelHandala has been on the radar of cybersecurity firms for years, but it gained widespread attention in recent days after ramping up its activity following the start of the US-Israel-Iran conflict.United StatesThe United States government has for the first time officially linked the notorious Handala hacker group to the Iranian government.
Industries
medical technologyHowever, its best-known attack targeted the US-based medical technology giant Stryker, causing significant disruption after wiping thousands of its systems.Oil and gasand deleting corporate data, publicly exposing details of intelligence personnel, and compromising an oil and gas exploration firm.