Handala Sites Display FBI Seizure Notices After Stryker Attack
Summary
Two Handala websites display FBI seizure notices after the group’s Stryker attack, which reportedly wiped about 80,000 devices. Handala acknowledged the seizures; officials have not publicly announced the action, and access to site data is unknown.
Key points
- handala-redwanted[.]to and handala-hack[.]to display notices claiming seizure under a warrant issued by a Maryland federal court.
- The notices allege the domains supported malicious cyber activity linked to a foreign state actor; the article reports no official law-enforcement announcement of the seizures.
- The domains’ name servers were changed to ns1[.]fbi[.]seized[.]gov and ns2[.]fbi[.]seized[.]gov; whether the FBI accessed site content or server logs is unknown.
- The article says Handala used a compromised Windows domain administrator account to create a Global Administrator account and issue Microsoft Intune wipe commands at Stryker.
- About 80,000 devices, including computers and mobile devices and some employees’ company-managed personal devices, were reportedly factory reset.
- Handala acknowledged the seizures and said it was building new websites; Microsoft and CISA issued guidance on hardening Windows domains and securing Intune.
Article Details
- Event Type
- FBI seizure of websites used by the Handala group following a destructive cyberattack on Stryker.
- Impact
- The Stryker attack reportedly compromised a domain administrator account, created a Global Administrator account, and used Microsoft Intune wipe commands to factory-reset approximately 80,000 corporate and company-managed personal devices. The FBI seized two Handala websites; the article says it is unknown whether the FBI also accessed their content or server logs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | Handala website seized by the FBI; the seizure notice states the domains supported malicious cyber activities. |
| DOMAIN | handala-redwanted[.]to | Handala website seized by the FBI; the seizure notice states the domains supported malicious cyber activities. |
MITRE ATT&CK
Threat Actors
HamsaThe article identifies Hamsa as another name for Handala, which it describes as conducting the attack on Stryker.HandalaThe article identifies Handala as the hacktivist group behind the attack on Stryker and says it acknowledged the website seizures.Handala Hack TeamThe article identifies Handala Hack Team as another name for Handala, which it describes as conducting the attack on Stryker.HatefThe article identifies Hatef as another name for Handala, which it describes as conducting the attack on Stryker.Iran’s Ministry of Intelligence and SecurityThe article says Handala operations were reportedly linked to Iran’s Ministry of Intelligence and Security; this is reported attribution, not confirmed responsibility.MOISThe article uses MOIS as an acronym for Iran’s Ministry of Intelligence and Security and says Handala operations were reportedly linked to it; this is not confirmed responsibility.
Vendors
Products
Countries
Iranhacktivist group that first appeared in December 2023, and conducted operations reportedly linked to Iran’s Ministry of Intelligence and Security (MOIS).United Statesbeen seized by the Federal Bureau of Investigation (“FBI”) pursuant to a seizure warrant issued by a United States District Court for the District of Maryland as apart of a law enforcement action by the FBI.