Threat actor
Handala Hack
Iran
Tracked by CyberSIXT since 12 Mar
- Articlesall time
- 4
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 2
4 articles from 1 outlet since 12 Mar; the latest 34 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 22 Sep · 07:11 UTC | SecurityOnline | Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram Accounts |
| Thu 7 May · 23:25 UTC | dti.domaintools.com | Fake Google Authenticator Chrome Extension Hits 260k Users |
| Thu 12 Mar · 22:19 UTC | Unit 42 | Insights: Increased Risk of Wiper Attacks |
| Thu 12 Mar · 17:45 UTC | Check Point | “Handala Hack” – Unveiling Group’s Modus Operandi |
Names and sources
9 names- Void Manticore
- CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
- BANISHED KITTEN
- MITRE ATT&CK®
- COBALT MYSTIQUE
- MITRE ATT&CK®
- Handala Hack
- MITRE ATT&CK®
- Homeland Justice
- MITRE ATT&CK®
- Karma
- MITRE ATT&CK®
- Karmabelow80
- MITRE ATT&CK®
- Red Sandstorm
- MITRE ATT&CK®
1 more names
- Karma/KarmaBelow80
- CyberSIXT coverage
Attributed facts
- Origin
Iran MISP Galaxy
Malware and tools
Malpedia · void_manticore 2
MITRE ATT&CK® techniques
63 techniques · 0 tacticsFrom MITRE ATT&CK® · G1055 · showing 12 of 63
Tactics pending refresh 12
- T1003.001
- LSASS Memory
- T1005
- Data from Local System
- T1021.001
- Remote Desktop Protocol
- T1027.015
- Compression
- T1036.004
- Masquerade Task or Service
- T1036.005
- Match Legitimate Resource Name or Location
- T1041
- Exfiltration Over C2 Channel
- T1047
- Windows Management Instrumentation
- T1059.001
- PowerShell
- T1059.006
- Python
- T1071.001
- Web Protocols
- T1072
- Software Deployment Tools
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram AccountsSecurityOnline
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- Insights: Increased Risk of Wiper AttacksUnit 42
- “Handala Hack” – Unveiling Group’s Modus OperandiCheck Point · first in our coverage