MrHex builds hack and leak operation targeting US industry

MrHex and associated handles Mr8ex, MrDarkRoot and Darku3er have been building a hack-and-leak ecosystem advertised on both the darknet and clearnet, according to DomainTools’ research. The group depicts itself as Iran-aligned, with hosting and activity in Iran and Persian-language reporting naming MrHex as an Iranian cyber actor.

They claim to have obtained information from Handala to redistribute, with Handala described as their “brothers” and cooperation reportedly acknowledged by MrDarkRoot on 30 September 2026. By September 2026, MrHex asserted attacks against U.S. industrial systems including chemical-injection, natural-gas, and crude-oil facilities; while video and screen-grab evidence offered some credibility, independent verification of physical damage remained lacking.

In early October 2026, the campaign shifted to circulating American company and government data for sale via new Telegram channels after MrHex sites were allegedly taken down; at the time of writing, the domains were completely down.

The infrastructure underpinning the campaign comprises JokerData[.]org and JokerData[.]shop, BlackLeaks[.]sbs, and MrHex[.]sbs, described as interconnected components of a single ecosystem that has evolved from data brokerage into a structured leak-and-influence operation. Evidence cited includes shared Cloudflare nameservers and overlapping victim data, plus cross-promotion across Telegram channels and actor-controlled sites.

The research notes a credible industrial-access video from 18 September 2026 showing a Windows-based HMI labelled “Station Verdad,” with batch records suggesting meaningful access to an industrial environment, though not demonstrating destructive manipulation.

While claims of a broader destruction-capability are not independently verified, the report concludes that MrHex represents a credible data-theft, leak-distribution and unauthorized-access threat with growing potential in OT contexts, in concert with Handala and Iran-linked information operations.