Handala

Handala, also known as Handala Hack and Handala Hacking Team, is a pro-Palestinian hacktivist persona associated with the Iranian Ministry of Intelligence and Security (MOIS)-affiliated threat actor Void Manticore, also tracked as Banished Kitten, Red Sandstorm, and Storm-0842. It emerged in late 2023 and primarily targets Israeli organizations, with additional activity against U.S. entities and individuals. Homeland Justice is a related persona associated with the same operational apparatus, rather than a distinct Handala subgroup. Handala targets government bodies, critical infrastructure, technology providers, healthcare organizations, and military personnel. Its operations combine phishing, credential-based intrusion, privilege escalation, persistence, data theft, disruptive attacks, and destructive malware with public leaks and psychological operations. It maintains dedicated leak channels and a data-leak site, using stolen information, politically framed messaging, and exaggerated impact claims to intimidate targets and influence public perceptions. In January 2025, Handala compromised an Israeli security vendor's centralized public-address management infrastructure and used connected audio systems at approximately 20 kindergartens to broadcast false alerts and propaganda. In March 2026, it published historical personal material from FBI Director Kash Patel's email account; the FBI acknowledged malicious targeting and stated that the exposed information contained no government material. Handala's public identity and messaging support Iranian influence objectives, using disruptive activity and hack-and-leak operations to undermine confidence in targeted institutions.