Threat actor
Handala Hack
Iran
Tracked by CyberSIXT since 12 Mar
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
10 articles from 1 outlet since 11 Mar; the latest 34 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 22 Sep · 07:11 UTC | SecurityOnline | Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram Accounts |
| Thu 7 May · 23:25 UTC | dti.domaintools.com | Fake Google Authenticator Chrome Extension Hits 260k Users |
| Fri 3 Apr · 09:04 UTC | Security Affairs | Pro-Iran Handala group breached Israeli defence contractor PSK Wind Technologies |
| Mon 30 Mar · 10:35 UTC | SOCRadar | Inside Handala’s Hack on the FBI Director |
| Sat 28 Mar · 10:50 UTC | Security Affairs | Iran-linked group Handala hacked FBI Director Kash Patel’s personal email account |
| Fri 13 Mar · 08:30 UTC | SOCRadar | Dark Web Profile: Handala Hack |
| Thu 12 Mar · 22:19 UTC | Unit 42 | Insights: Increased Risk of Wiper Attacks |
| Thu 12 Mar · 17:45 UTC | Check Point | “Handala Hack” – Unveiling Group’s Modus Operandi |
| Wed 11 Mar · 20:55 UTC | Security Affairs | Pro-Palestinian hacktivist group Handala targets Stryker in global disruption |
| Wed 11 Mar · 16:49 UTC | SecurityWeek | MedTech Giant Stryker Crippled by Iran-Linked Hacker Attack |
Names and sources
- Void Manticore
- Named by CyberSIXT coverage
- Void Manticore
- Named by Malpedia · void_manticore
- Void Manticore
- Named by MISP Galaxy · 53ac2695-35ba-4ab2-a5cd-48ca533f1b72
- BANISHED KITTEN
- Named by MITRE ATT&CK® · G1055
- COBALT MYSTIQUE
- Named by MITRE ATT&CK® · G1055
- Handala Hack
- Named by MITRE ATT&CK® · G1055
- Homeland Justice
- Named by MITRE ATT&CK® · G1055
- Karma
- Named by MITRE ATT&CK® · G1055
All 13 names
- Karmabelow80
- Named by MITRE ATT&CK® · G1055
- Red Sandstorm
- Named by MITRE ATT&CK® · G1055
- VOID MANTICORE
- Named by MITRE ATT&CK® · G1055
- Karma/KarmaBelow80
- Named by CyberSIXT coverage
- 53ac2695-35ba-4ab2-a5cd-48ca533f1b72
- Named by CyberSIXT coverage
Attributed facts
- origin
- Iran (MISP Galaxy · 53ac2695-35ba-4ab2-a5cd-48ca533f1b72)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1055
Tactics pending refresh
- T1003.001
- LSASS Memory
- T1005
- Data from Local System
- T1021.001
- Remote Desktop Protocol
- T1027.015
- Compression
- T1036.004
- Masquerade Task or Service
- T1036.005
- Match Legitimate Resource Name or Location
- T1041
- Exfiltration Over C2 Channel
- T1047
- Windows Management Instrumentation
- T1059.001
- PowerShell
- T1059.006
- Python
- T1071.001
- Web Protocols
- T1072
- Software Deployment Tools
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram AccountsSecurityOnline
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- Pro-Iran Handala group breached Israeli defence contractor PSK Wind TechnologiesSecurity Affairs
- Inside Handala’s Hack on the FBI DirectorSOCRadar
- Iran-linked group Handala hacked FBI Director Kash Patel’s personal email accountSecurity Affairs
- Dark Web Profile: Handala HackSOCRadar
- Insights: Increased Risk of Wiper AttacksUnit 42
- “Handala Hack” – Unveiling Group’s Modus OperandiCheck Point
- Pro-Palestinian hacktivist group Handala targets Stryker in global disruptionSecurity Affairs
- MedTech Giant Stryker Crippled by Iran-Linked Hacker AttackSecurityWeek · first in our coverage