Handala

Profile narrative

Handala, also tracked as Handala Hack, Hanzalah Hacking Group, Banished Kitten and several other aliases, is an Iranian‑linked threat actor that has been active since at least 2008. Public attributions tie the group to Iran’s Ministry of Intelligence and Security, with the U.S. Justice Department describing it as a front operated by that ministry to conduct psychological operations and claim responsibility for cyberattacks. The group’s known operational base is in Iran, and it has been observed using online platforms such as Telegram to publish claims and leaked data.

Handala’s targeting has focused on organizations in the United States, particularly those in critical infrastructure and the medical technology sector. It has claimed intrusions against a California water utility, a medical device manufacturer (Stryker), and the personal email account of an FBI director, stating that these actions were intended as warnings or retaliation for U.S. strikes in Iran. The actor’s stated objectives include delivering a psychological signal, demonstrating access to sensitive systems, and, in some cases, disrupting operations without seeking financial gain.

Observed tactics involve exploiting externally exposed services, using stolen or default credentials, and leveraging phishing to gain an initial foothold. Handala has been noted to compromise Microsoft Intune environments to execute mass wipes of Windows devices, employing custom wiper tools such as win.handala, Handala Wiper and Hamsa Wiper, as well as MBR‑overwriting capabilities. The group also makes use of commodity malware for credential harvesting, scans for vulnerable programmable logic controllers and VPNs, and relies on old, unpatched flaws like CVE‑2021‑22681. Notable operations include the March 2026 Stryker incident that wiped tens of thousands of devices, the June 2026 California Water Service breach that accessed a single customer account and a GPS correction tool, and the March 2026 claim of accessing the FBI director’s personal email. These activities illustrate a pattern of initial claims followed by potentially escalatory actions, with the actor emphasizing disruption and signaling rather than monetary profit. Handala continues to be monitored as an extension of Iranian state‑linked cyber influence.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 41 sources.