Handala Hacking Team
Handala Hacking Team is a pro-Palestinian hacktivist group active since at least 2023, with some reporting placing activity since at least December 2023. The group heavily targets Israeli organizations and organizations doing business in Israel, and has also been reported targeting critical vertical organizations in Israel. Reported claimed targeting spans Business Services, Construction & Engineering, Technology, Government, Transportation, and other critical sectors during periods of heightened regional tensions. The group operates a data leak site and has claimed attacks against organizations in Israel, although reporting notes hacktivist personas may exaggerate operational impact and at least one organization publicly dismissed Handala claims of attack or data exfiltration. Observed and reported activity includes data theft, phishing, extortion, website defacement, disruptive and destructive attacks, and hack-and-leak style operations. In one reported July 2024 campaign exploiting the CrowdStrike outage as a lure, Handala Hacking Team was attributed by Cisco Talos and others to a destructive wiper operation delivered via spearphishing PDF attachments. The infection chain used an NSIS installer, an obfuscated batch script, staged AutoIt components, and injected a decompressed wiper into regasm.exe. The malware performed host and network reconnaissance, checked for security products, used a Telegram bot as command-and-control, and overwrote then deleted files, potentially rendering systems unbootable. The campaign also reportedly used a BYOVD-style step involving ListOpenedFileDrv_32.sys loaded by OpenFileFinder.dll. Reporting also states the group has been observed routing traffic through StarLink and scanning externally facing applications for vulnerabilities. Handala Hacking Team uses the Handala character created by Naji al-Ali across social media accounts on Telegram, Tox, and X. No additional aliases or sub-groups were directly identified in the provided content beyond the name Handala Hacking Team.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Commercial & Professional Services
- Capital Goods
- Software & Services
- Transportation
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
Tradecraft
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned hacktivist activity cluster reported targeting Israeli organizations, operating a data leak site and conducting scanning for vulnerabilities in externally facing applications; noted use of Starlink-routed traffic.
Hacktivist group active since 2023 that claims attacks during periods of heightened geopolitical tension, including against Israeli organizations; operates a data leak site and is associated (per claims and historical patterns) with defacements, DDoS, data exfiltration/leaks, and potentially disruptive malware deployment.
Pro-Palestinian hacktivist group active since at least Dec 2023, heavily targeting Israeli organizations (and those doing business in/supporting Israel). In this campaign, they exploited the CrowdStrike BSOD outage as a lure in spear-phishing to deliver a destructive custom wiper. They use phishing (including SMS), extortion/data-leak-site pressure, defacement, and destructive attacks. The wiper chain uses NSIS installers, obfuscated batch scripts, AutoIt-based payload staging, Telegram bot C2/exfil, process injection into regasm.exe, and BYOVD via ListOpenedFileDrv_32.sys loaded by OpenFileFinder.dll to support destructive operations (wipe/overwrite+delete).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.