MOISIRAN

MOISIRAN is a Telegram-based operational persona assessed to be part of an Iran-linked Ministry of Intelligence (MOIS) threat cluster associated with the broader Handala brand and the actor commonly tracked as Void Manticore, also known as TAG-145, Red Sandstorm, and Banished Kitten. The persona emerged in April 2026 and has been used to claim surveillance of Israeli military, intelligence, law-enforcement, and nuclear-related personnel. It fits a wider MOIS pattern of using reusable personas that present as independent activist or resistance entities while supporting coordinated cyber, espionage, influence, intimidation, and proxy-enablement activity. MOISIRAN appears to function primarily as a surveillance, intimidation, and amplification persona rather than as a standalone malware brand. Its activity is consistent with reconnaissance and espionage-oriented operations focused on identifying, monitoring, and psychologically pressuring Israeli targets. Reporting links MOISIRAN to coordination with VIPEmployment-linked channels and assesses that it operates under the same MOIS-controlled Handala ecosystem that also includes Handala Hack Team, Handala Popular Resistance Front, and Brave Israel. Within that ecosystem, associated personas have supported hack-and-leak operations, destructive attacks, recruitment of proxies for espionage and sabotage, and claims of physical attacks, indicating a multidomain operational model in which cyber and non-cyber activities reinforce one another. The broader cluster has historically targeted Israel, Iranian opposition figures, and, increasingly, the United States. In MOISIRAN’s case, the directly observed focus is Israel, especially intelligence, security, and state-linked individuals. The dominant motivation is espionage in service of Iranian state interests.