Loading threat actor…
Handala is an Iran-linked cyber persona widely assessed to be operated by the Iranian Ministry of Intelligence and Security (MOIS). It has also been tracked under aliases including VOID MANTICORE, Homeland Justice, Red Sandstorm, Storm-0842, Banished Kitten, Dune, and related Handala-branded variants. U.S. government reporting has described Handala as a fictitious persona within an MOIS-controlled cyber ecosystem, and an FBI affidavit has linked Handala, Homeland Justice, and Karma Below to the same operators. The actor combines ideological messaging, psychological operations, disruptive activity, credential theft, surveillance, and data theft. Its operations have prominently targeted Israel, Albania, and the United States, including government entities, media, healthcare-related organizations, payment services, and water-sector infrastructure. Handala has publicly framed some intrusions as retaliation tied to regional conflict and has used Telegram and similar channels to amplify reputational and psychological impact by publicizing claimed breaches and stolen data. Handala and closely linked personas have been associated with destructive and extortion-oriented operations against Albania since 2022, including campaigns affecting government systems, border-control functions, telecommunications, aviation, and parliamentary targets. Those operations included ransomware and destructive activity, as well as wiper deployment intended to render systems unbootable. The actor has also been tied to attacks and claims involving U.S. and Israeli organizations, including healthcare and water-sector victims, though some operational-technology disruption claims have exceeded publicly verified impact. Tradecraft attributed to Handala or the linked VOID MANTICORE cluster includes use of trojanized applications for persistent surveillance, PowerShell executed in hidden windows, credential extraction from Windows registry hives, automated file discovery and collection, exploitation of public-facing applications, and DNS-based command-and-control. Reporting also links the actor to distribution or use of commodity malware such as Rhadamanthys in at least one campaign, as well as use of remote administration, proxying, and lateral-movement tooling in destructive operations. The actor’s behavior reflects a blend of espionage-style access and collection with coercive, disruptive, and influence-oriented effects.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
32 malware families attributed to this actor across reporting.
27 additional families tracked in Mallory.
9 CVEs this actor has used in observed campaigns. 9 of them exploited in the wild.
VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604. For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.
CVEs Weaponized by This Cluster CVE-2017-7921 — Hikvision auth bypass (historical reuse)
One of the Hikvision vulnerabilities (CVE-2021-3626; command injection) grants an attacker full root access to control the device.
CVEs Weaponized by This Cluster CVE-2023-6895 — IP camera RCE
CVEs Weaponized by This Cluster CVE-2024-55591 — FortiOS authentication bypass (modified exploit creates super_admin accounts)
4 more CVEs tied to this actor tracked in Mallory.
153 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed attacks against Stryker and Verifone as part of a broader wave of cyberattacks tied in the article to geopolitical retaliation.
Iran-linked hacktivist group cited as having disrupted Stryker’s operations and claimed responsibility for hacking the personal Gmail account of FBI director Kash Patel.
Iran-linked cyber persona/group presented as part of an MOIS-controlled cyber ecosystem used to provide deniability and support coercive, influence, espionage, and potentially disruptive cyber operations.
Claimed responsibility for a cyberattack against Stryker, a medical technology company, framing it as retaliation tied to geopolitical conflict and deliberately targeting the healthcare sector.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.