cyber.hendryadrian.com
Threat Research · dti.domaintools.com

DomainTools Links Homeland Justice, Karma and Handala to an MOIS-Aligned Cyber Campaign

· Original article ↗

Summary

DomainTools assesses Homeland Justice, Karma and Handala as personas in an MOIS-aligned campaign that has evolved from destructive intrusions into espionage, surveillance, hack-and-leak operations and influence activity.

Key points

  • The analysis links the personas through reported continuity in timing, tradecraft, infrastructure and public messaging, while assessing that they serve distinct roles within a coordinated ecosystem.
  • The 2022 Albania operation reportedly involved long-term access through an exposed SharePoint vulnerability, credential theft, lateral movement, data exfiltration and destructive wiping.
  • Later operations used a mix of custom tools, legitimate utilities and native administrative capabilities for intrusion, surveillance and disruption.
  • The report describes trojanized applications and Telegram’s Bot API being used to support targeted surveillance and malware command-and-control.
  • The analysis identifies rotating, persona-branded domains and Telegram channels as infrastructure for public claims, leak publication and campaign amplification.
  • In the reported 2026 Stryker incident, attackers allegedly abused Microsoft Intune administrative access to wipe large numbers of enrolled devices; the article cites reports of operational disruption and data exfiltration.

Article Details

Attack Vectors
  • The Albania intrusion reportedly began by exploiting an internet-facing Microsoft SharePoint vulnerability approximately fourteen months before public disclosure. The article also describes exploitation of exposed Exchange systems.
  • Targeted phishing and trojanized messaging applications, password managers, and media utilities are described as entry points for surveillance operations against dissidents, journalists, activists, and opposition networks.
  • Webshells, registry modifications, scheduled tasks, and reused credentials support persistent access. Harvested credentials enable lateral movement through RDP, SMB, and WMI.
  • Operators collect credentials from configuration files, email systems, browser stores, and LSASS memory, including through rundll32 and comsvcs.dll.
  • Surveillance implants collect screenshots, keystrokes, clipboard contents, files, and audio, stage and compress collected data locally, and use Telegram's Bot API for tasking and exfiltration.
  • Destructive operations combine custom wipers, PowerShell deletion scripts, manual formatting, secure deletion utilities, and encryption through VeraCrypt.
  • Reporting cited for the March 2026 Stryker incident suggests compromise of a Microsoft Intune administrative account or management console, enabling centralized remote wiping without traditional endpoint malware deployment.
  • Actor-operated websites and social channels publish or reference stolen material, amplify destructive claims, and support intimidation and doxxing.
Defensive Notes
  • The article distinguishes confirmed disruption and exposure from partially corroborated or unverified claims. Verifone denied the alleged compromise, while the full scale of the claimed Hebrew University of Jerusalem attack lacks strong independent confirmation.
  • The article states that Telegram API abuse blends command-and-control and exfiltration with legitimate service traffic, making network telemetry alone insufficient to reliably distinguish malicious use.
  • Reported abuse of Microsoft Intune demonstrates that destructive activity can originate from enterprise management authority without requiring endpoint malware artifacts.
  • The article describes domain rotation and simultaneous regeneration of multiple personas; disruption of individual publication domains does not necessarily remove the underlying operational capability.
  • Handala publication domains are described as leak and messaging infrastructure, not malware-hosting or command-and-control infrastructure.
  • Signed binaries and native administrative utilities are described as mechanisms for reducing endpoint scrutiny and blending malicious operations with legitimate administration.

Indicators of compromise

TypeIndicatorContext
DOMAINhandala-hack[.]proHandala-branded infrastructure provisioned during the reported March 2026 registration burst.
DOMAINhandala-hack[.]psHandala-controlled publication infrastructure described as part of its rotating domain ecosystem.
DOMAINhandala-hack[.]shopHandala-branded infrastructure provisioned during the reported March 2026 registration burst.
DOMAINhandala-hack[.]toHandala-controlled domain used to publish breach claims and reference stolen data.
DOMAINhandala-hack[.]twHandala-controlled publication domain used for operational claims and infrastructure redundancy.
DOMAINhandala-redwant[.]toHandala infrastructure registered during the reported March 2026 burst, associated with leak-and-shame branding.
DOMAINhandala-redwanted[.]ccHandala infrastructure registered during the reported March 2026 burst, associated with leak-and-shame branding.
DOMAINhandala-redwanted[.]toHandala-controlled publication node associated with intimidation and doxxing.
DOMAINhomelandjustice[.]cxDomain attributed to the actor ecosystem; the article assesses that it likely supports alternate or backend operations.
DOMAINkarmabelow80[.]bizKarmaBelow80 infrastructure registered during the reported March 2026 multi-persona regeneration.
DOMAINkarmabelow80[.]orgActor-operated public-facing node for messaging, leak publication, and intimidation.
DOMAINkarmabelow80[.]stKarmaBelow80 infrastructure registered during the reported March 2026 multi-persona regeneration.
MD50738242a521bdfe1f3ecc173f1726aa1Goxml.jpg decoy or payload carrier identified as a masquerading artifact.
MD51635e1acd72809479e21b0ac5497a79bwin.bat script in the Albania operation's execution chain.
MD518e01dee14167c1cf8a58b6a648ee049Variant of the win.bat execution-chain script.
MD51e6b601f733bc40eaa58916986bfc5b9Pictory_premium_ver9.0.4.exe first-stage loader used as an initial-access lure.
MD52965817d063f1e8f9889f9126443d631Variant of the rantom.txt supporting data artifact.
MD53236facc7a30df4ba4e57fddfba41ec5VeraCrypt Installer explicitly listed as an attacker-used artifact for destructive encryption.
MD53cb9dea916432ffb8784ac36d1f2d3cdPowerShell Wiper script used for recursive deletion.
MD53dfb151d082df7937b01e2bb6030fe4aNetBird Installer explicitly listed as an attacker-used artifact supporting lateral connectivity.
MD53e7a2fcef1d038d05b20148c573a6499MsCache.exe data-theft payload used for cache extraction.
MD5481c5b5e69a08c3df206c59fd8ddc0dcwinappx.exe execution artifact in the surveillance malware chain.
MD55986ab04dd6b3d259935249741d3eff2handala.exe custom wiper identified as a core destructive payload.
MD559a85e8ec23ef5b5c215cd5c8e5bc2abbb.bat deployment script used in the Albania operation.
MD560afb1e62ac61424a542b8c7b4d2cf01disable_defender.exe defense-evasion artifact identified as disabling antivirus.
MD57402f2f9263782a4c469570035843510KeePass.exe first-stage loader masquerading as legitimate software.
MD578562ba0069d4235f28efd01e3f32a82mellona.exe propagation artifact supporting lateral movement in the Albania operation.
MD57b71764236f244ae971742ee1bc6b098cl.exe disk-wiping payload used for raw disk overwrite in the Albania operation.
MD57e23ffadb664b0e53d821478a249d84csmqdservice.exe persistence artifact in the surveillance malware chain.
MD581e123351eb80e605ad73268a5653ff3Error4.aspx webshell used for initial persistence.
MD58f6e7653807ebb57ecc549cef991d505rwdsk.sys driver supporting raw disk access in the destructive operation.
MD58f766dea3afd410ebcd5df5994a3c571Pickers.aspx webshell providing an additional access vector.
MD5a3394ef7ffa7e88b2e7efaee4617fe04rantom.txt supporting data artifact explicitly listed for the Telegram surveillance operation.
MD5a9fa6cfdba41c57d8094545e9b56db36ClientBin.aspx webshell used for IIS-based control.
MD5b9086413e7b6a0c6a11c25d14c22615fTelegram_Authenticator.exe first-stage loader in the Telegram surveillance operation.
MD5bbe983dba3bf319621b447618548b740GoXML.exe primary encryption payload in the Albania operation.
MD5d70ebf20e3d697897bad5bebf72ea271MicDriver.exe surveillance payload used for audio capture.
MD5e035c858c1969cffc1a4978b86e90a30NetBird artifact explicitly listed as supporting attacker persistence.
MD5e51ff37fb431767dcdec0b5e6d2a786aRuntimeSSH.exe backdoor variant in the surveillance operation.
MD5ebdd9595b79b39f53909d862499dbc94Source-listed MD5 for RuntimeSSH.exe reverse-SSH backdoor; value preserved exactly as supplied.
MD5f8b5554808428291acc65d1fd2efe01cMicDriver.dll supporting artifact in the surveillance malware chain.
SHA25636cc72c55f572fe02836f25516d18fed1de768e7f29af7bdf469b52a3fe2531fPtable.exe / NACL.exe signed No-Justice disk-wiping binary described as preventing operating system boot.

MITRE ATT&CK

T1003.001 · LSASS MemoryOperators use rundll32 and comsvcs.dll to dump LSASS memory and obtain credentials or hashes.T1005 · Data from Local SystemOperators harvest files and other local data for intelligence collection and subsequent leaks.T1018 · Remote System DiscoveryInternal reconnaissance identifies systems and maps network topology before lateral expansion and destruction.T1021.001 · Remote Desktop ProtocolOperators use RDP with harvested credentials to move across compromised environments.T1021.002 · SMB/Windows Admin SharesOperators use SMB for lateral movement while blending with normal administrative traffic.T1036 · MasqueradingTrojanized applications impersonate legitimate software; Karma Shell is disguised as an error page and Goxml.jpg is listed as a masquerading artifact.T1041 · Exfiltration Over C2 ChannelSurveillance implants transmit collected data through their Telegram-based command-and-control channel.T1047 · Windows Management InstrumentationWMI is explicitly described as a mechanism used during lateral movement.T1053.005 · Scheduled TaskScheduled tasks maintain execution at startup or defined intervals on compromised Windows systems.T1056.001 · KeyloggingThe surveillance implants are described as collecting keystrokes.T1059 · Command and Scripting InterpreterOperators use command-line utilities for execution, manual deletion, and disk formatting.T1059.001 · PowerShellPowerShell supports payload delivery, propagation, and recursive destructive deletion.T1069 · Permission Groups DiscoveryADRecon is used to examine Active Directory permissions and group structures.T1071.001 · Web ProtocolsSurveillance implants communicate through standard Telegram API web requests for tasking and data transfer.T1074.001 · Local Data StagingCollected files and surveillance data are staged locally before transfer.T1078 · Valid AccountsOperators reuse harvested privileged credentials for continued access and lateral expansion; Stryker reporting suggests compromise of an Intune administrative account.T1087 · Account DiscoveryADRecon and account enumeration provide visibility into enterprise users and accounts.T1102 · Web ServiceTelegram is abused as a legitimate web service supporting malware command-and-control.T1113 · Screen CaptureSurveillance implants capture screenshots for continuous monitoring.T1114.002 · Remote Email CollectionCompromised Exchange infrastructure enables mailbox access and extraction of sensitive communications.T1115 · Clipboard DataThe surveillance implants are described as capturing clipboard contents.T1123 · Audio CaptureSurveillance components capture audio, including from conferencing applications.T1190 · Exploit Public-Facing ApplicationOperators exploited internet-facing SharePoint and reportedly Exchange systems to establish enterprise footholds.T1204.002 · Malicious FileTargets execute trojanized applications presented as messaging clients, password managers, or media utilities.T1218.011 · Rundll32Native rundll32 is used with comsvcs.dll in the LSASS dumping workflow.T1484.001 · Group Policy ModificationHandala operations use Group Policy to centrally deploy and coordinate destructive actions across enterprise systems.T1485 · Data DestructionOperators use custom wipers, SDelete, manual file deletion, and PowerShell recursive deletion to destroy data.T1486 · Data Encrypted for ImpactGoXML.exe and later abuse of VeraCrypt encrypt data as part of destructive operations.T1505.003 · Web ShellWebshells on compromised servers, including IIS, provide persistent remote access and command execution.T1547.001 · Registry Run Keys / Startup FolderSurveillance persistence includes registry-based startup mechanisms, identified as registry Run keys in the appendix.T1552.001 · Credentials In FilesActors extract credentials from configuration files in compromised environments.T1555.003 · Credentials from Web BrowsersBrowser credential stores are identified as a source of harvested credentials.T1560 · Archive Collected DataOperators compress locally staged data before exfiltration.T1561.001 · Disk Content Wipecl.exe performs raw disk overwrite, and later destructive activity includes disk wiping and formatting.T1561.002 · Disk Structure WipeNo-Justice Wiper corrupts structures required for operating system startup, preventing successful boot.T1562.001 · Disable or Modify ToolsThe Albania artifact table identifies disable_defender.exe as an antivirus-disabling component.T1566 · PhishingThe article describes targeted phishing as an initial-access method in later surveillance activity.T1572 · Protocol TunnelingReverse SSH tunneling is used in the Karma phase and by RuntimeSSH.exe surveillance backdoors.T1583.001 · DomainsThe actor provisions rotating branded domains, including a concentrated registration burst across Handala, KarmaBelow80, and Homeland Justice identities.T1585.001 · Social Media AccountsThe ecosystem maintains and reconstitutes Telegram channels and uses X accounts to amplify claims and leak references.

People

Deborah OppenheimerTarget of claimed private-communications exposure with limited corroboration of downstream effects.Eran OrtalTarget of claimed communications and strategic-document exposure, without confirmed operational consequences.Ilan SteinerTarget of claimed exposure of approximately 50,000 emails, without confirmed secondary impact.Kash PatelPersonal emails, images, and documents were publicly exposed in a Handala-linked breach; the article says the material was not assessed as sensitive government information.Seyed Yahya Hosseini PanjakiReportedly affiliated with MOIS; the article assesses that his involvement represents a command-level role overseeing the operational ecosystem.Sima ShineTarget of claimed exposure of approximately 100,000 emails, without confirmed downstream operational disruption.

Threat Actors

HandalaPersona associated with destructive operations, leaks, doxxing, and influence activity. The article assesses continuity with Homeland Justice and Karma-related identities rather than organizational independence.Homeland JusticePersona associated with destructive Albanian intrusions and hack-and-leak activity. The article assesses it as an operational identity within the same MOIS-aligned apparatus as Karma, KarmaBelow80, and Handala.KarmaPersona used for operations against Israeli organizations after October 2023. The article assesses it as a rebranding within the same apparatus as Homeland Justice, KarmaBelow80, and Handala.KarmaBelow80Persona associated with the Karma cluster and actor-operated publication domains. The article assesses it as part of the same MOIS-aligned apparatus as Homeland Justice and Handala.MOIST GRASSHOPPERNamed in the article title as a MOIS-linked cluster associated with the researched persona ecosystem; the body does not establish a precise alias relationship.Void ManticoreNamed alongside Karma in the appendix covering destructive operations against Israel during October 2023 through mid-2024; no explicit alias relationship is established.

Malware

BiBi Wiperwebshells, credential validation tools, reverse SSH tunneling, and destructive mechanisms such as BiBi Wiper.cl.execombined ransomware-style encryption with destructive wiping, employing tools such as GoXML.exe and cl.exe, supported by propagation utilities and raw disk access drivers that enabled direct manipulation ofClientBin.aspxClientBin.aspxError4.aspxError4.aspxGoXML.exeAlbania operation combined ransomware-style encryption with destructive wiping, employing tools such as GoXML.exe and cl.exe, supported by propagation utilities and raw disk access drivers that enabled directhandala.exehandala.exeKarma Shellwithout introducing large, easily detectable binaries. Custom elements, including webshells (e.g., Karma Shell) and credential validation tools (e.g., do.exe), were used selectively to maintain access and verifyKeePass.exeKeePass.exeMicDriver.exeMicDriver.exeMsCache.exeMsCache.exeNo-Justice WiperDuring this period, the introduction of the No-Justice Wiper marked a refinement in destructive tooling. Designed for rapid and irreversible disruption, the malware emphasized system incapacitation, including preventingPickers.aspxPickers.aspxPictory_premium_ver9.0.4.exePictory_premium_ver9.0.4.exePowerShell WiperPowerShell WiperRuntimeSSH.exeRuntimeSSH.exeTelegram_Authenticator.exeTelegram_Authenticator.exeWhatssApp.exeWhatssApp.exe

Vendors

Microsoftaccess approximately fourteen months prior to public disclosure by exploiting an internet-facing Microsoft SharePoint vulnerability. This early foothold indicates a deliberate pre-positioning phase, consistent

Products

Active Directoryand remote control across segmented networks, while ADRecon provided comprehensive visibility into Active Directory structures, users, and permissions. This combination allowed operators to map target environments inIIScontrol over compromised systems even in the face of remediation efforts. Webshells, often deployed on IIS or similar web servers, provide durable remote access and are frequently reused or redeployed as needed.Linuxallowed rapid adaptation to differences in target infrastructure  whether on-premises Windows domains, Linux servers, or mixed environments while preserving the ability to execute high-impact actions.Microsoft ExchangeThe compromise of Microsoft Exchange infrastructure further expanded access. By leveraging Exchange, the actors were able to access and manipulate mailboxes, create or modify accounts, and extract large volumes ofMicrosoft Intuneactors achieved administrative access to enterprise management infrastructure, specifically Microsoft Intune, and used it as a force-multiplier for both disruption and scale. (Cyber Magazine)Microsoft SharePointaccess approximately fourteen months prior to public disclosure by exploiting an internet-facing Microsoft SharePoint vulnerability. This early foothold indicates a deliberate pre-positioning phase, consistent withMicrosoft Windowstime, and allowed rapid adaptation to differences in target infrastructure  whether on-premises Windows domains, Linux servers, or mixed environments while preserving the ability to execute high-impact actions.NetBirdenabled the actors to operate more effectively within complex network environments. Tools such as NetBird facilitated persistent internal connectivity and remote control across segmented networks, while ADReconTelegramresearch, passive DNS and infrastructure enrichment, and longitudinal review of archived web and Telegram content supports a high-confidence assessment that the personas Homeland Justice, Karma, and Handala doVeraCryptcustom wipers, PowerShell-based recursive deletion, and encryption via legitimate tools such as VeraCrypt. These methods were often executed in tandem across multiple systems, ensuring redundancy in effect andWordPressincluding handala-hack[.]tw remains structurally consistent. The sites themselves are simple, often WordPress-based, with minimal technical sophistication. They do not host malware, nor do they expose

Tools

ADReconNetBird facilitated persistent internal connectivity and remote control across segmented networks, while ADRecon provided comprehensive visibility into Active Directory structures, users, and permissions. Thisdisable_defender.exedisable_defender.exedo.exebinaries. Custom elements, including webshells (e.g., Karma Shell) and credential validation tools (e.g., do.exe), were used selectively to maintain access and verify privileges, while publicly available tools such asmellona.exemellona.exePowerShellboot. The use of signed binaries suggests an increased emphasis on evasion and trust abuse, while PowerShell-based propagation reflects a growing reliance on native system capabilities to enable flexible andreGeorgwere used selectively to maintain access and verify privileges, while publicly available tools such as reGeorg enabled post-compromise control. This blend allowed operators to pivot quickly within compromisedreGeorgereGeorgeSDeleteprotocols such as RDP for lateral movement, built-in command-line tools, and common utilities like SDelete or disk formatting to perform destructive actions without introducing large, easily detectable binaries.

Countries

Albaniaand behavioral alignment. Activity transitions seamlessly from Homeland Justice operations targeting Albania in 2022 to Karma campaigns against Israeli entities in late 2023, and subsequently to Handala-brandedIranaligned actors, but as a structured, state-directed campaign operating under the authority of Iran’s Ministry of Intelligence and Security (MOIS). When viewed through the lens of command-and-control,IsraelFollowing the Israel-Hamas conflict in October 2023, the campaign expanded geographically and adopted the Karma persona.

Industries

Defenseleaks focused on individual targets, often framed as penetrations of named Israeli intelligence or defense figures. The content emphasized access mailboxes, communications, and internal correspondence withoutEducationEnergyIsraeli Energy GridGovernmentThe evidence examined across this analysis spanning U.S. government reporting, private-sector threat intelligence research, passive DNS and infrastructure enrichment, and longitudinal review of archived web and TelegramManufacturingReporting indicates that the intrusion disrupted core business functions, including order processing, manufacturing, and shipment operations, with recovery extending over multiple days. The incident also reportedlyMediahere is distributed across a population, amplifying fear and discouraging participation in opposition or media activities.Paymentswaterintelligence, where the actor claims to possess detailed knowledge of critical systems such as water and electricity networks. Each category serves a distinct psychological function: exposure, intimidation,

Related Articles