Handala Profile Details MOIS Links, Wiper Campaigns and Tradecraft
Summary
SOCRadar profiles Handala, which multiple vendors assess as an Iran MOIS-linked destructive persona. It details claimed operations, a phishing-to-wiper chain, and mitigations; Stryker confirmed global disruption, while Handala's wipe and data-theft figures remain claims
Key points
- Multiple vendors assess Handala as a destructive persona linked to Iran's Ministry of Intelligence and Security; other tracking names include Void Manticore and Storm-0842.
- Reporting describes a division of labor in which Scarred Manticore establishes access and Void Manticore/Handala conducts disruptive or destructive operations.
- The July 2024 CrowdStrike-themed phishing campaign used staged NSIS installers, obfuscated scripts, AutoIT loaders, process hollowing into RegAsm.exe, and a wiper payload.
- The article describes custom wipers, BYOVD using ListOpenedFileDrv_32.sys, and Telegram Bot API use for command-and-control and telemetry.
- Stryker confirmed severe global disruption in an SEC filing; Handala claimed it wiped more than 200,000 systems and extracted 50 TB. Microsoft Intune MDM abuse was suspected as a delivery mechanism.
- Recommended defenses include phishing-resistant MFA, monitoring script and LOLBin activity, blocking untrusted drivers, behavioral EDR, and maintaining offline or immutable backups.
Article Details
- Attack Vectors
- Spear-phishing emails and links used lures tied to major events, including the July 2024 CrowdStrike outage, to direct victims to malicious archives containing disguised installers.
- The reported delivery chain used NSIS installers, obfuscated scripts, and AutoIT loaders before deploying a wiper.
- Scarred Manticore was reported to establish initial access, including through exploitation of internet-facing SharePoint vulnerabilities such as CVE-2019-0604; access involving web shells and Domain Admin credentials was then reportedly transferred to Void Manticore/Handala for disruptive activity.
- The July 2024 campaign reportedly used process hollowing into RegAsm.exe. Microsoft Intune MDM abuse was suspected as the delivery mechanism in the Stryker incident.
- Defensive Notes
- Use phishing-resistant MFA and email filtering to block malicious attachments and links; train employees to recognize event-themed phishing lures.
- Monitor abnormal execution of installers, batch scripts, AutoIT, PowerShell, and legitimate Windows utilities such as RegAsm.exe.
- Inspect outbound connections and restrict unauthorized communication with messaging platforms used for command and control.
- Use vulnerable-driver blocklists and prevent loading unsigned or untrusted kernel drivers.
- Deploy behavioral endpoint detections for process hollowing, payload reconstruction, and destructive malware activity.
- Maintain offline or immutable backups to support recovery from wiper attacks.
- Identify exposed SharePoint instances, unpatched internet-facing applications, and misconfigured MDM platforms.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaigns used obfuscated scripts and payloads, including obfuscated batch scripts.T1055.012 · Process HollowingThe attack-chain description reports process hollowing into RegAsm.exe.T1059 · Command and Scripting InterpreterThe delivery chain used obfuscated batch scripts and scripting frameworks to reconstruct and execute payload components.T1059.010 · AutoHotKey & AutoITAutoIT loaders were used in the multi-stage execution chain before the final wiper stage.T1190 · Exploit Public-Facing ApplicationScarred Manticore was reported to gain initial access through vulnerabilities in internet-facing applications, including SharePoint vulnerability CVE-2019-0604.T1204 · User ExecutionVictims were directed to download and run a disguised installer from a malicious archive.T1218 · System Binary Proxy ExecutionRegAsm.exe was identified as a legitimate Windows binary abused for payload execution.T1485 · Data DestructionCustom wipers were deployed to destroy data and render systems unusable, including in the reported Stryker operation.T1505.003 · Web ShellWeb shells were reported among the access obtained during the initial-access phase before activity was transferred to the destructive operators.T1566.001 · Spearphishing AttachmentThe July 2024 campaign lured victims to download malicious archives containing disguised installers.T1566.002 · Spearphishing LinkThe article describes spear-phishing emails and links used to deliver staged payloads.
CVE
People
Nariman GharibThe article identifies Gharib as an Iranian researcher who connected the operation to a cyber unit inside the MOIS counter-terrorism division.Rafael FrancoFormer Israeli National Cyber Directorate deputy head who characterized Handala as focused primarily on psychological and media impact.Yahya Hosseini PanjakiThe article identifies Panjaki as the deputy minister leading the MOIS counter-terrorism division cyber unit to which the operation was connected by researcher Nariman Gharib.
Threat Actors
Banished KittenThe article identifies BANISHED KITTEN as a tracking name for the same activity cluster tracked by Check Point Research as Void Manticore, which is reported to conduct destructive operations.DuneThe article identifies Dune as a tracking name for the same activity cluster tracked by Check Point Research as Void Manticore, which is reported to conduct destructive operations.HandalaThe article describes Handala as a destructive cyber persona assessed with high confidence by multiple vendors to be operated by Iran’s MOIS. It reports claimed attacks and wiper deployments, while cautioning that some claims may be exaggerated or unconfirmed.Handala_hackThe article identifies Handala_hack as another styling of Handala, the persona reported to conduct claimed attacks and destructive wiper operations.MOISHandala is assessed with high confidence by multiple vendors to be a destructive cyber persona operated by Iran’s Ministry of Intelligence and Security (MOIS).OilRigThe article links Scarred Manticore to activity associated with OilRig; it does not establish that OilRig and Scarred Manticore are aliases.Scarred ManticoreOperational reporting cited in the article says Scarred Manticore typically establishes initial access and conducts intelligence collection before transferring access to Void Manticore and Handala.SOLAR IONThe article links Scarred Manticore to activity associated with APT34; it does not establish that APT34 and Scarred Manticore are aliases.Storm-0842The article identifies Storm-0842 as a tracking name for the same activity cluster tracked by Check Point Research as Void Manticore, which is reported to conduct destructive operations.Void ManticoreCheck Point Research tracks the activity as Void Manticore; the article says other tracking systems use names including Storm-0842, BANISHED KITTEN, and Dune for the same activity cluster. Void Manticore is reported to conduct the destructive stage after access is obtained.
Malware
BiBi Wiper[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).ChillWipe[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).Cl Wiper[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).CoolWipe[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).Hamsa[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).Handala Wiper[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).Hatef[Malware names ] documented custom destructive payloads – BiBi Wiper, Hatef, and 5 more variants (Hamsa, Cl Wiper, CoolWipe, ChillWipe, Handala Wiper).
Vendors
CrowdStrikeNotable operations include a CrowdStrike-themed phishing wiper campaign (July 2024), alleged breaches of Israeli institutions, kindergarten PA system compromises, and the March 2026 Stryker global wipe.MicrosoftCloud Accounts – Abuse of valid cloud/MDM accounts for lateral movement or deployment (suspected Microsoft Intune MDM abuse in Stryker incident) (‘Microsoft Intune MDM abuse was suspected as the delivery
Products
CrowdStrike Windows sensorFollowing the global CrowdStrike Windows sensor outage that caused widespread BSOD failures, attackers launched a phishing campaign targeting Israeli organizations with fake remediation tools. Victims were directed toMicrosoft Intune MDMCloud Accounts – Abuse of valid cloud/MDM accounts for lateral movement or deployment (suspected Microsoft Intune MDM abuse in Stryker incident) (‘Microsoft Intune MDM abuse was suspected as the delivery mechanism’).Microsoft SharePoint(‘frequently establishes the initial foothold… through vulnerabilities such as CVE-2019-0604 in Microsoft SharePoint’).Microsoft WindowsFollowing the global CrowdStrike Windows sensor outage that caused widespread BSOD failures, attackers launched a phishing campaign targeting Israeli organizations with fake remediation tools. Victims were directed toTelegram Bot API[T1090 ] Proxy – Use of proxying techniques and intermediary channels for C2 and telemetry (‘Proxy’ and lightweight command channels cited; Telegram Bot API used as C2 and telemetry channel).
Tools
AutoItHandala uses multi-stage delivery (NSIS installers, obfuscated scripts, AutoIT loaders), living-off-the-land abuse (RegAsm.exe), BYOVD kernel drivers, and Telegram-based C2/telemetry.NSISHandala uses multi-stage delivery (NSIS installers, obfuscated scripts, AutoIT loaders), living-off-the-land abuse (RegAsm.exe), BYOVD kernel drivers, and Telegram-based C2/telemetry.PowerShellScript monitoring: Detect abnormal execution of installers, batch scripts, and scripting tools such as AutoIT or PowerShell.
Countries
Iranbut is assessed with high confidence by multiple vendors to be a destructive cyber persona operated by Iran’s Ministry of Intelligence and Security (MOIS).IsraelThe timing was deliberate: the group emerged weeks after the October 7, 2023 Hamas attack on Israel, positioning itself within the wave of pro-Palestinian hacktivist activity that followed.JordanClaimed victims have included Jordan’s fuel infrastructure, Bank of Jordan, Sharjah Airport, Riyadh Bank, Israeli energy firms, and the Academy of the Hebrew Language, while Western organizations in the United StatesUnited Kingdomfirms, and the Academy of the Hebrew Language, while Western organizations in the United States and United Kingdom have also faced increasing exposure.United Statesdeployed custom wiper malware against civilian infrastructure, and escalated to operations targeting U.S.
Industries
Critical infrastructureBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.EducationBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.EnergyBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.financialBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.Government and defenseBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.Information TechnologyBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.TechnologyBy sector, technology is the most frequently targeted industry, followed by information technology, government and defense, critical infrastructure, energy, education, and financial.