Handala Announces New Domain Hours After FBI Seizes Older Sites
Summary
Handala announced handala-hack[.]ps hours after the FBI seized domains allegedly linked to Iran’s MOIS; researchers saw rerouting to a similar site. Stryker says restoration is progressing, though some customers still face disruptions.
Key points
- The FBI seized four domains allegedly linked to Iran’s MOIS and used for threats and “name and shame” campaigns.
- Handala acknowledged the seizure on Telegram, characterized it as censorship, and said its efforts would continue on new platforms.
- Handala announced handala-hack[.]ps within hours; Cyble researchers observed rerouting to a similar clearnet site, with moderate confidence.
- Handala claimed it wiped more than 200,000 Stryker devices and siphoned petabytes of data; those claims are not independently established in the article.
- Stryker said the attack was contained to its Microsoft environment and restoration had made significant progress, while some personalized-implant customers still experienced disruptions.
Article Details
- Event Type
- FBI seizure of domains allegedly linked to Iran-associated cyber operators, followed by Handala Hack Team's announcement of a replacement domain
- Impact
- The seized sites were reportedly used for threats and “name and shame” campaigns targeting journalists, dissidents, and people linked to Israel. Handala Hack Team claimed responsibility for an attack on Stryker and claimed it wiped more than 200,000 devices and took petabytes of data. Stryker said the incident was contained to its Microsoft environment and had no customer impact, while also reporting supply-chain effects and continuing disruptions for some personalized-implant customers as restoration progressed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]ps | Replacement domain announced by Handala Hack Team after the FBI seizure, described in the article as new domain infrastructure. |
| DOMAIN | handala-hack[.]to | Domain seized by the FBI and reportedly used for threats and “name and shame” activity linked to Iran-associated operators. |
| DOMAIN | handala-redwanted[.]to | Domain seized by the FBI and reportedly used for threats and “name and shame” activity linked to Iran-associated operators. |
| DOMAIN | justicehomeland[.]org | Domain seized by the FBI and reportedly used for threats and “name and shame” activity linked to Iran-associated operators. |
| DOMAIN | karmabelow80[.]org | Domain seized by the FBI and reportedly used for threats and “name and shame” activity linked to Iran-associated operators. |
Threat Actors
Handala Hack TeamThe article identifies the group as an Iran-linked hacker group that announced a replacement domain after the FBI seized domains allegedly tied to it. The group claimed responsibility for the Stryker attack and claimed it wiped more than 200,000 devices and took petabytes of data.Iran’s Ministry of Intelligence and Security (MOIS)The seized domains were alleged to be a front for MOIS; the article says court documents described the domains as operated by the same individuals and part of the same conspiracy.
Vendors
Countries
IranHandala Hack Team went back online hours after the FBI announced the seizure of clearnet domains tied to Iran-linked operators accused of issuing threats and conducting “name and shame” campaigns.United StatesIranian hacker group Handala Hack Team, the collective behind the famed cyberattack on U.S.