Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to malware
MalwareUsed by 3 actors

Handala wiper

Handala Wiper is a custom destructive malware family associated with the Iranian MOIS-linked threat cluster tracked as Void Manticore, also known as Red Sandstorm and Banished Kitten, operating under the Handala Hack persona. Reporting describes it as part of Handala’s broader destructive toolkit used in hack-and-leak and impact operations targeting organizations in Israel, Albania, and more recently the United States, including the March 2026 Stryker incident. The malware has been observed in Windows-focused destructive operations and is also referenced alongside related Handala tooling and Linux-targeting wipers such as Hamsa.

High-confidence reporting states that Handala Wiper is distributed during the impact phase via Group Policy logon scripts and scheduled tasks, including through a batch file named handala.bat, allowing execution from the Domain Controller without writing the executable to disk on every endpoint. In some cases the payload is referred to as handala.exe. Its destructive behavior includes overwriting file contents and corrupting or overwriting the Master Boot Record (MBR) to cause deep system damage and hinder recovery. In observed campaigns, it has been deployed in parallel with other destructive methods, including a custom PowerShell-based wiper that deletes files in user directories and drops handala.gif, VeraCrypt-based disk encryption, and manual deletion of files and virtual machines over RDP.

The actor using Handala Wiper commonly gains access through compromised VPN credentials, brute force, credential stuffing, or supply-chain compromise of IT/service providers, then performs hands-on-keyboard operations, credential dumping, Active Directory reconnaissance, and lateral movement primarily over RDP, sometimes using NetBird for tunneling to internal hosts. The malware is linked in the content to destructive campaigns rather than espionage, with emphasis on operational disruption, data destruction, and psychological impact. Detection content in the supporting material associates Handala Wiper activity with anomalous high-volume file deletion on Windows, suspicious use of regasm/regsvcs-related behaviors, and reconnaissance such as querying public IP-check services.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Handala

Handala Malware Capability: While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.

via dataminrdataminr.com
Handala Hack

The first is the custom Handala Wiper, distributed via Group Policy logon scripts through a batch file named handala.bat. This wiper overwrites file contents and applies Master Boot Record (MBR) corruption for deep, low-level damage.

via cyber security newscybersecuritynews.com
Handala Hacking Team

This event was subsequently exploited by threat actors to launch malicious campaigns, one in particular looking to deploy destructive wiper payloads to targeted hosts and network systems.

via splunk security blogsplunk.com
MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566.001Spearphishing AttachmentEvidence1

“Spear Phishing Attachment (T1566.001) The phishing campaign utilizes a .PDF attachment to deceive users… The document contains a link… directs users to malicious software that wipes the compromised systems.”

T1566.002Spearphishing LinkEvidence1

Victims were directed to download a malicious archive containing a disguised installer that deployed a destructive wiper payload.

Execution

4 techniques
T1053Scheduled Task/JobEvidence1

During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...

T1053.005Scheduled TaskEvidence1

The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...

T1059Command and Scripting InterpreterEvidence3

Handala campaigns typically use a staged execution chain designed to evade detection. Payload components are reconstructed at runtime and delivered through scripting frameworks before deploying the final wiper payload.

T1059.010AutoHotKey & AutoITEvidence2

Handala Destructive Wiper detection involves monitoring for suspicious activities such as ... unauthorized AutoIt script executions ...

Persistence

4 techniques
T1037Boot or Logon Initialization ScriptsEvidence1

initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.

T1037.003Network Logon ScriptEvidence1

The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat.

T1053Scheduled Task/JobEvidence1

During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...

T1053.005Scheduled TaskEvidence1

The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...

Privilege Escalation

6 techniques
T1037Boot or Logon Initialization ScriptsEvidence1

initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.

T1037.003Network Logon ScriptEvidence1

The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat.

T1053Scheduled Task/JobEvidence1

During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...

T1053.005Scheduled TaskEvidence1

The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...

T1068Exploitation for Privilege EscalationEvidence1

“Exploitation for Privilege Escalation BYOVD (T1068)… employs… ‘Bring Your Own Vulnerable Driver’ (BYOVD), utilizing a driver named ListOpenedFileDrv_32.sys… loaded as a service…”

T1484.001Group Policy ModificationEvidence2

Wipers are often pushed via GPO (e.g., handala.bat) so that the executable runs from the Domain Controller without being written to disk on every endpoint.

Stealth

6 techniques
T1014RootkitEvidence1

Handala Destructive Wiper detection involves monitoring for suspicious activities such as ... the dropping of malicious drivers.

T1027Obfuscated Files or InformationEvidence1

“Obfuscated Files or Information (T1027) …scatters garbage or invalid Windows commands among legitimate batch script instructions… effectively masks the true functionality of the script while allowing it to run as intended.”

T1036MasqueradingEvidence1

Executables Or Script Creation In Temp Path ... T1036

T1070.004File DeletionEvidence1

Handala Destructive Wiper is a potent malware strain known for its destructive capabilities. It targets and irreversibly wipes data from infected systems, rendering them inoperable.

T1218.009Regsvcs/RegasmEvidence3

Handala Destructive Wiper detection involves monitoring for suspicious activities such as unexpected regasm processes...

T1497.003Time Based ChecksEvidence1

“Time Based Evasion (T1497.003)… If these processes are not detected, the script instructs the system to pause execution for approximately 90 to 180 seconds by using the “ping -n” parameter.”

Defense Impairment

1 technique
T1484.001Group Policy ModificationEvidence2

Wipers are often pushed via GPO (e.g., handala.bat) so that the executable runs from the Domain Controller without being written to disk on every endpoint.

Discovery

1 technique
T1497.003Time Based ChecksEvidence1

“Time Based Evasion (T1497.003)… If these processes are not detected, the script instructs the system to pause execution for approximately 90 to 180 seconds by using the “ping -n” parameter.”

Exfiltration

1 technique
T1020Automated ExfiltrationEvidence1

“Automated Exfiltration (T1020)… created a [Telegram] bot to serve as the C2… responsible for sending information from the compromised host…”

Impact

4 techniques
T1485Data DestructionEvidence7

Handala Malware Capability: While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.

T1561Disk WipeEvidence1

Handala Malware Capability: While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.

T1561.001Disk Content WipeEvidence1

During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping...

T1561.002Disk Structure WipeEvidence4

MITRE ATT&CK TTPs Tactic ID Technique Impact T1561.002 Disk Structure Wipe

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app2 months ago
ip.v4●●●●●●●●●●●●View more in app2 months ago
ip.v4●●●●●●●●●●●●View more in app2 months ago
ip.v4●●●●●●●●●●●●View more in app2 months ago
ip.v4●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.