HandalaThreat actor
Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware. The group utilizes a multi-stage loading process, including a Delphi-coded second-stage loader and an AutoIT injector, to deliver wiper malware that specifically targets Windows and Linux environments.From MISP Galaxy
Last reported 27 days ago, by CERT-EU8 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
- T1195Supply Chain Compromise
“A compromised supplier may expose customer identities and trusted administrative paths, but it’s only a software supply-chain compromise if there is evidence that downstream customers, builds, updates, or distribution were affected.”
- T1036Masquerading
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
- T1176.001Browser Extensions
“Researchers unveiled BragJack, an attack that allows malicious browser extensions to hijack AI assistants by forcing prompts through trusted browser channels.”
- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1213.005Messaging Applications
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Cyber Brief 26-04 - March 2026“FBI seized Handala data leak site after Stryker cyberattack”
-
21st September – Threat Intelligence Report“Researchers revealed HEAVYGRAM, a Windows surveillance backdoor linked with moderate confidence to the Iranian Handala group.”
-
Risky Bulletin: Gemini hacked three companies too“Handala's HEAVYGRAM: A new report looks at HEAVYGRAM, a Telegram-based Windows backdoor used by the Handala Hack Iranian group since the fall of 2023.”
-
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack“Handala is assessed to be an online persona of Void Manticore — also tracked as Storm-0842, Banished Kitten, and Red Sandstorm — a destructive-and-leak actor assessed to operate on behalf of MOIS.”
-
July 2026 Dark Web Threat Actor Trend Report“Handala claimed to have compromised the core infrastructure of an Internet service provider in North America, causing a large-scale Internet outage.”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“MOIS-linked personas such as Handala, Homeland Justice, and Karma combine intrusion, destruction, disclosure, and coercion.”
-
Why the Stryker Attack Still Matters. And Five Steps You Can Take Today“…’t yet confirmed the exact technical specifics, the reported details suggest a "perfect storm." Attackers (linked to the pro-Iran group Handala) didn't need to bypass their firewall with complex malware.”
-
This month in security with Tony Anscombe – March 2026 edition“The medtech giant Stryker fell victim to a cyberattack that was claimed by the Iran-linked Handala hacktivist group and reportedly wiped “over 200,000 systems, servers, and mobile devices” and stole 50 terabytes of data,”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- justicehomeland[.]orgin 1 report
- karmabelow80[.]orgin 1 report
- handala-redwanted[.]toin 1 report
- handala-hack[.]toin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/in 1 report
- sgp1.vultrobjects[.]comin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/efg_d4.zipin 1 report
- hxxps://api.telegram[.]org/bot783XXXX576in 1 report
- hxxps://api.telegram[.]org/bot772XXXX818in 1 report
- hxxps://api.telegram[.]org/file/in 1 report
- 8219453084f370ce…d82d617f26ddin 1 report
- 0190940243f6535f…43d493159e14in 1 report
- b3c1a3eebefafe1346c6a864b5423182in 1 report
- 47fa634b13b8ba35…68f848825de4in 1 report
- 88a8d118ee190ac3…6ddd2dda517bin 1 report
- b2f6f40570ac9085b5463fdb623560dein 1 report
- d2d19c7f2e4a5fdc…df32307c377ein 1 report
- 9108466c98df0103…0c23372c52f2in 1 report
- 16602375fc2dae1eb54580ab7eda6567in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.