U.S. Seizes Four Domains Linked to Iran-Backed Cyberattacks and Threats
Summary
The DOJ seized four domains authorities link to Iran’s MOIS, saying they supported cyberattack claims, data leaks and threats against journalists, dissidents and people linked to Israel. Investigators describe fake hacktivist fronts combining disruptive activity with
Key points
- The Justice Department seized four domains allegedly operated by Iran’s Ministry of Intelligence and Security (MOIS), which authorities say were used to claim cyberattacks, publish data and issue threats.
- Investigators said the sites posed as hacktivist groups and shared infrastructure, including Iranian IP ranges and leak platforms.
- Court documents say Handala-Redwanted published identifying details of nearly 190 people associated with the Israeli Defense Force and government, alongside threatening messages.
- The group claimed it stole 851 gigabytes of data from members of the Sanzer Hasidic Jewish community; the article provides no independent confirmation of the claim.
- Investigators said email accounts tied to the operation sent threats to journalists and Iranian dissidents, including references to home addresses and rewards for violence.
- Handala-Hack claimed a March 2026 malware attack on a U.S. medical technology company. Officials said the domain seizure was intended to disrupt the network.
Article Details
- Event Type
- U.S. Justice Department seizure of four domains allegedly operated by Iran’s Ministry of Intelligence and Security (MOIS) as part of a cyberattack, data-leak, and online-intimidation campaign.
- Impact
- The seizure disrupted websites used to claim responsibility for cyberattacks, publish stolen data, and threaten journalists, dissidents, and people linked to Israel. The reported campaign also included a malware attack claim targeting a U.S. medical technology company and data-theft claims involving Albanian government systems and members of the Sanzer Hasidic Jewish community. Officials warned that similar tactics may persist.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | Domain seized by the U.S. Justice Department; the article says it was used to claim a March 2026 malware attack on a U.S. medical technology company. |
| DOMAIN | handala-redwanted[.]to | Domain seized by the U.S. Justice Department; the article says it was used to publish identifying details of people associated with the Israeli Defense Force and government. |
| DOMAIN | justicehomeland[.]org | Domain seized by the U.S. Justice Department; authorities say it was tied to the operation and used to claim responsibility for data theft. |
| DOMAIN | karmabelow80[.]org | Domain seized by the U.S. Justice Department; authorities say it was tied to the operation and had been used to claim data theft targeting Albanian government systems. |
People
Threat Actors
Handala-hackThe article describes a platform under this name as claiming responsibility for a March 2026 malware attack; it says the sites were fronts for an operation allegedly linked to MOIS.Ministry of Intelligence and SecurityInvestigators and authorities allegedly linked the seized domains and campaign to Iran’s Ministry of Intelligence and Security (MOIS); the article describes the operation as state-backed.
Countries
IranJustice Department seized four domains tied to Iran’s Ministry of Intelligence and Security (MOIS), disrupting a state-backed campaign that combined cyberattacks, data leaks, and online intimidation.IsraelThe operation used fake hacktivist fronts to publish stolen data and directly threaten journalists, dissidents, and individuals linked to Israel, signaling a shift toward visibility-driven, person-targeted attacks.United StatesThe U.S. Justice Department seized four domains tied to Iran’s Ministry of Intelligence and Security (MOIS), disrupting a state-backed campaign that combined cyberattacks, data leaks, and online intimidation.