PUBLISHED on 6 April 2026, Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment describes a single, coordinated cyber influence ecosystem aligned with Iran’s Ministry of Intelligence and Security (MOIS), not a collection of independent groups.
The activity attributed to Homeland Justice, Karma/KarmaBelow80, and Handala is framed as an integrated apparatus where multiple identities are used as interchangeable veneers to enable messaging segmentation while maintaining a shared infrastructure and tradecraft.
The analysis traces the campaign from the 2022 Albania operations, which established a model of long-term access, structured data exfiltration, and narrative-focused disruption, through to later phases that blended custom tooling with publicly available utilities and hands-on-keyboard tradecraft. Telegram-based command-and-control and surveillance tooling are cited as shifts toward persistent, person-centric targeting, with infrastructure designed to be ephemeral while identity and narrative persist.
The report highlights a convergence of intrusion, surveillance, disruption and influence into a unified framework, where the hype cycle and media amplification are treated as operational objectives on par with technical access.