Quick links
Press Enter to search, Esc to close
Threat group profile
Handala Hack is a persona that MITRE ATT&CK lists under VOID MANTICORE (G1055), a group assessed to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS).
In short
Handala Hack is a persona that MITRE ATT&CK lists under VOID MANTICORE (G1055), a group assessed to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS). The US Department of Justice (19 March 2026) says the Handala domains were MOIS-controlled, and the FBI (20 March 2026) assesses Handala Hack is linked to the Homeland Justice persona, also operated by MOIS cyber actors.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| VOID MANTICORE | MITRE ATT&CK group name (G1055)[1] |
| Handala Hack | MITRE ATT&CK Associated Groups, where it is called the group's current primary persona; FBI FLASH of 20 March 2026; Department of Justice release of 19 March 2026[1, 2, 3] |
| Handala Hack Team | Department of Justice release (the persona's own wording in a threat email); CERT-EU Cyber Brief 26-04[3, 6] |
| Homeland Justice | MITRE ATT&CK Associated Groups; FBI FLASH of 20 March 2026; AA22-264A (as HomeLand Justice)[1, 2, 5] |
| Karma | MITRE ATT&CK Associated Groups[1] |
| Karmabelow80 | MITRE ATT&CK Associated Groups; name of a domain in the Department of Justice release[1, 3] |
| COBALT MYSTIQUE | MITRE ATT&CK Associated Groups[1] |
| BANISHED KITTEN | MITRE ATT&CK Associated Groups[1] |
| Red Sandstorm | MITRE ATT&CK Associated Groups[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK page created 20 April 2026, version 1.0 modified 31 July 2026
Describes VOID MANTICORE as a group assessed to operate on behalf of Iran's MOIS, active since at least mid-2022. Lists several personas, including HomeLand Justice (operations against Albania), Karma and Karma Below (campaigns against Israeli organizations) and Handala Hack, which it calls the current primary persona.[1]
US Department of Justice 19 March 2026
Announced the court-authorized seizure of four domains it says were used by MOIS for psychological operations: claiming credit for hacks, posting stolen data and calling for the killing of journalists, dissidents and Israeli persons.[3]
US Department of Justice 19 March 2026
Says the FBI found the four domains linked through shared leak sites, Iranian IP ranges and a common "playbook" of destructive attacks and "faketivist" operations using stolen data.[3]
US Department of Justice 19 March 2026
Says, as alleged in court documents, that the MOIS-controlled domains handala-hack[.]to and handala-redwanted[.]to published personal details of targeted people after the US-Iran conflict began on 28 February 2026.[3]
US Department of Justice 19 March 2026
Says the FBI found that the email account Handala_Team@outlook[.]com sent death threats to Iranian dissidents and journalists in the United States and abroad, offering bounties.[3]
FBI 20 March 2026
In FLASH-20260320-001, assesses that Handala Hack is linked to the online entity Homeland Justice, also operated by Iran MOIS cyber actors, and is known for phishing, data theft, extortion and destructive attacks with custom wiper malware.[2]
FBI 20 March 2026
Assesses that some information Handala Hack claimed in a July 2025 hack-and-leak operation was obtained with malware from a campaign against dissidents. Assesses that MOIS cyber actors use state-directed APT and proxy groups for hacktivist-style attacks.[2]
CISA and FBI 21 September 2022
In AA22-264A, say Iranian state cyber actors, identifying as "HomeLand Justice", attacked the Government of Albania in July 2022. The advisory does not name Handala or MOIS.[5]
CISA 18 March 2026
Alert on endpoint management hardening after a cyberattack on a US medical technology firm on 11 March 2026. It names no threat actor.[4]
CERT-EU March 2026
Cyber Brief 26-04 calls Handala Hack Team a pro-Iran "supposed hacktivist group" and "Iran-linked", and reports the FBI takedown of its leak site.[6]
Sources differ in wording and certainty: MITRE ATT&CK says VOID MANTICORE is "assessed to operate on behalf of" MOIS and treats Handala Hack as one of its personas. The Department of Justice calls the Handala domains "MOIS-controlled" but describes the persona claiming hacks, not MOIS officers carrying them out. The FBI FLASH calls Handala Hack an "online entity" linked to Homeland Justice and does not use the name VOID MANTICORE. CISA's alert on the 11 March 2026 attack names no actor, so that link rests on the persona's own claim (reported by the Department of Justice) and on MITRE. On dates, MITRE says active since at least mid-2022 but lists the HomeLand Justice campaign from May 2021.
Each entry is attributed to the group by the sources cited.
AA22-264A says HomeLand Justice claimed credit for the cyber attack on Albanian government infrastructure, which used a file encryptor and then a ZeroCleare wiper.[5]
AA22-264A says Iranian cyber actors launched another wave using similar methods and malware, likely in retaliation for the public attribution of the July attacks.[5]
The FBI assesses MOIS cyber actors deployed multiple versions of its malware against Windows machines, dating back to the fall of 2023.[2]
The FBI says Handala Hack claimed a hack-and-leak operation against people voicing concerns about events in Iran.[2]
The Department of Justice dates the start of the US-Iran conflict to this day and says the Handala sites then published personal details of targeted people.[3]
The Department of Justice says the Handala_Team email account sent death threats to two victims on or about this date.[3]
The Department of Justice says the persona posted data on people it said worked for the Israeli military and claimed 851 GB from members of a Hasidic Jewish community.[3]
The Department of Justice says the persona's second site posted names and personal details of about 190 people tied to the Israeli military or government.[3]
CERT-EU reports that Albania's parliament reported an attack on its systems and that Homeland Justice claimed it.[6]
The Department of Justice announces the seizure of four domains: two used for the Handala persona, and two it calls the official websites of a shell hacktivist entity used by MOIS (the Albania-era Homeland Justice and Karmabelow80 names).[3]
The FBI publishes FLASH-20260320-001 on the Telegram-controlled malware used against dissidents and journalists.[2]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 21 Sep 2022 | CISA and FBI | Joint cybersecurity advisory AA22-264ATimeline of the July and September 2022 attacks on the Government of Albania by Iranian state cyber actors identifying as HomeLand Justice, with indicators and mitigations.[5] |
| 18 Mar 2026 | CISA | Alert on endpoint management systemsUrges least privilege roles, phishing-resistant multi-factor authentication and multi-admin approval for high-impact actions such as device wiping. Names no threat actor.[4] |
| 19 Mar 2026 | US Department of Justice and FBI (District of Maryland) | Court-authorized domain seizureFour domains seized: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org and Handala-Redwanted[.]to. The release reports a seizure and does not announce charges against named people.[3] |
| 19 Mar 2026 | US Department of Justice | Mention of a Rewards for Justice offerThe release says the State Department program offers up to 10 million US dollars for information on people acting for a foreign government who carry out certain malicious cyber activity against US critical infrastructure. The release does not say the offer names Handala.[3] |
| 20 Mar 2026 | FBI | FLASH-20260320-001Describes the Telegram-controlled malware, file names and hashes, and mitigations.[2] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Acquire Infrastructure: Domains T1583.001
MITRE says it registered domains for messaging, created lookalike domains and replaced disrupted domains with new ones.[1]
Establish Accounts: Social Media Accounts T1585.001
MITRE says it ran personas such as Handala Hack, Karma and Homeland Justice on Telegram and X to amplify claims and data leaks.[1]
Phishing T1566
MITRE says phishing was used for initial access and threatening emails were sent to victims.[1]
Exploit Public-Facing Application T1190
MITRE lists a SharePoint flaw (CVE-2019-0604) used in the HomeLand Justice case, and AA22-264A describes it as the way in for the Albania attack.[1, 5]
External Remote Services T1133
MITRE says the group used public-facing VPN infrastructure to get in.[1]
Valid Accounts T1078
MITRE says it used compromised valid credentials, including for VPN and management systems.[1]
User Execution: Malicious File T1204.002
The FBI describes victims persuaded over messaging apps to accept a file posing as Pictory, KeePass or Telegram software.[1, 2]
Software Deployment Tools T1072
MITRE says it used built-in features of device-management and remote-monitoring platforms, including remote wipe from a privileged cloud device-management account.[1, 14]
Cloud Administration Command T1651
MITRE says it abused built-in remote wipe or factory reset commands on devices managed in a cloud console.[1, 13]
ROADSWEEP Ransomware
MITRE lists it as ransomware deployed against Albanian government networks in the HomeLand Justice case.[1, 7]
ZeroCleare Wiper
AA22-264A says a version of ZeroCleare destructive malware was deployed in the July 2022 attack on Albania.[5, 8]
CHIMNEYSWEEP Backdoor
MITRE lists it as a backdoor deployed during HomeLand Justice.[9]
RawDisk Driver used by wipers
MITRE lists it under the group's software as a legitimate commercial driver.[1, 10]
Impacket Open source tool
MITRE says it was used in the HomeLand Justice case, with RDP and the built-in administrator account for lateral movement.[1, 11]
Mimikatz Credential dumper
MITRE lists it among tools used in the HomeLand Justice case.[1, 12]
Telegram-controlled implants Multi-stage malware
The FBI describes first-stage files posing as Telegram, WhatsApp, KeePass and Pictory software, and second-stage implants controlled through a Telegram bot, with parts that record screen and audio during a Zoom call.[2]
BiBi Wiper Wiper
MITRE says the group used custom malware and wipers, including BiBi Wiper.[1]
VeraCrypt and NetBird Legitimate software
MITRE says the group used a legitimate disk encryption utility (VeraCrypt) and installed NetBird on victim devices to control several at once.[1]
The FBI advises regular operating system and software updates. MITRE lists the use of a SharePoint flaw in the 2022 Albania case, so patch internet-facing servers first.
Counters T1190
The FBI asks people to report suspicious emails and messages, and to contact a local FBI field office if a crime is suspected.
Counters T1566
Follow government and MITRE reporting on this persona and compare the listed techniques with your own detection and controls.
Find lookalike domains that copy your brand, a method MITRE describes for this group.
Watch for leaked or sold company credentials and for claims about your organization on leak sites, which the Department of Justice describes as part of this persona's activity.
See which VPN, remote access and web systems such as SharePoint your organization exposes to the internet.
Check whether personal details of senior staff appear in leaks, as the Department of Justice says the persona posted personal details of people it named.
Handala Hack is an online persona. MITRE ATT&CK lists it under VOID MANTICORE (G1055), assessed to operate on behalf of Iran's Ministry of Intelligence and Security. The US Department of Justice (19 March 2026) says the Handala domains were MOIS-controlled.
Sources differ in wording. The Department of Justice calls its work "faketivist" activity, CERT-EU calls it a "supposed hacktivist group", and the FBI says MOIS cyber actors use proxy groups for hacktivist-style attacks. MITRE treats it as a persona of VOID MANTICORE.
On 19 March 2026 the Department of Justice and FBI seized four domains, including Handala-Hack[.]to and Handala-Redwanted[.]to. On 20 March 2026 the FBI published a FLASH on the Telegram-controlled malware. The release reports a seizure and does not announce charges against named people.
MITRE lists phishing, stolen or guessed passwords, VPN access and a SharePoint flaw. The FBI describes contact through messaging apps and a file that looks like a normal program. MITRE also says a privileged device-management account was used to send remote wipe commands.
Follow CISA's alert of 18 March 2026: least privilege roles, phishing-resistant multi-factor authentication and a second approver for high-impact actions such as device wiping.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.