MrHex

MrHex, also known by the handle Mr8ex, is an Iran-aligned hack-and-leak operation focused on publishing and selling data concerning United States and Israeli institutions and individuals. Its public-facing ecosystem uses dedicated leak portals, Telegram channels, and underground forums to distribute searchable records and bulk archives. Published collections include material concerning military personnel, police, intelligence agencies, government officials, and political figures. The operation uses several associated personas with distinct roles: MrHex is the principal public identity, MrDarkRoot advertises and sells data, and Darku3er acts as a transactional contact for buyers. These personas form a coordinated publication and sales ecosystem rather than independently established subgroups. MrHex has documented data-redistribution ties to Handala. MrDarkRoot publicly acknowledged receiving information from Handala, and the operation incorporates Handala references into its branding. Some distributed material originated in earlier Handala and CyberAv3ngers leaks, so publication does not establish that MrHex conducted the underlying compromises. Its Iran alignment does not establish direct control by a particular Iranian government agency. The operation combines public disclosure with commercial data sales. Its claims of attacks against U.S. industrial infrastructure have not been independently verified, and no resulting physical damage has been confirmed.