Handala Hack Team Linked to Iran’s MOIS After Attacks on Stryker and FBI Director
Summary
Darkowl reviews Handala’s attacks and tactics, including disruption at Stryker and a breach claim involving FBI Director Kash Patel. The Justice Department confirmed the group’s link to Iran’s MOIS and seized four associated domains.
Key points
- Handala emerged in 2023 as a pro-Palestinian hacktivist persona; the Justice Department later confirmed its connection to Iran’s Ministry of Intelligence and Security.
- In March 2026, Handala claimed it wiped Stryker devices and stole data. Stryker reported a global Windows disruption, but said investigators found no malware or ransomware.
- The Justice Department said MOIS used Handala-linked domains and seized four: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to.
- Handala claimed it breached FBI Director Kash Patel’s personal email and released historical material. The FBI said no government information was acquired or breached.
- Earlier activity included a claimed attack involving DRS RADA, phishing texts targeting Israeli residents, and a reported ransomware attack on Ma’agan Michael Kibbutz.
- The article describes Handala’s tactics as combining social engineering, commercially available tools, custom payloads, and living-off-the-land methods, alongside exaggerated impact claims.
Article Details
- Event Type
- Cyberattacks attributed to the Handala Hack Team, including attacks on Stryker and FBI Director Kash Patel.
- Impact
- Handala claimed to wipe more than 200,000 Stryker systems and extract 50 terabytes of data; Stryker reported a global disruption affecting its Windows environment, but said its investigation found no malware or ransomware. Handala also claimed to breach Kash Patel’s personal email and released historical personal material; the FBI said no government information was acquired or breached. Earlier claims involving DRS RADA were not supported by released data, and the article reports no confirmed large-scale exfiltration in that incident.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | handala-hack[.]to | Domain the Justice Department said MOIS used to carry out the Stryker attack. |
| DOMAIN | handala-redwanted[.]to | Domain identified among four domains used by Handala and seized by the Justice Department. |
| DOMAIN | justicehomeland[.]org | Domain identified among four domains used by Handala and seized by the Justice Department. |
| DOMAIN | karmabelow80[.]org | Domain identified among four domains used by Handala and seized by the Justice Department. |
MITRE ATT&CK
People
Threat Actors
Ababil of MinabNamed as a pro-Iranian group whose propaganda and cyber operations were described as similar to those attributed to Handala.APT IRANNamed as a pro-Iranian group whose propaganda and cyber operations were described as similar to those attributed to Handala.HandalaName used in the article for the Handala Hack Team.Handala Hack TeamGroup attributed responsibility for attacks including those against Stryker and Kash Patel; the article also refers to it as Handala.Iran’s Ministry of Intelligence and Security (MOIS)The Justice Department confirmed a connection between MOIS and Handala and said MOIS used Handala-hack[.]to to carry out the Stryker attack.
Products
Iron DomeThe first large scale attack by Handala targeted Israel’s Iron Dome.Microsoft WindowsStryker spokesperson announced, “We are currently experiencing a global network disruption affecting the Windows environment.” Originally it was assumed the group used wiper malware but following an investigationMyCityUsing a spear-phishing tactic, residents of the Ma’ala Yosef Regional Council received text messages that appeared to come from the MyCity mobile app, a crisis management platform used by local authorities.
Countries
IranIt was widely regarded as a front for Iran’s cyberwarfare operations and as one of several personas employed by the Iranian Ministry of Intelligence to claim responsibility for cyberattacks, a conclusion later confirmedIsraelThe group described itself as a “small fighter of Hamas,” suggesting it was formed in response to the October 7 attacks that marked the start of the Israel–Hamas war.