Handala
Handala is described in the provided content as a destructive wiper malware and also as the name used for a Delphi-coded second-stage loader in the Operation HamsaUpdate intrusion chain. The malware is associated in reporting with the Iran-aligned or Iran-linked Handala group, including claims of disruptive and destructive operations with political messaging and attacks against Israeli and healthcare-related targets. Reported victimology includes critical infrastructure and organizations broadly, a medical technology organization in 2026, and Stryker, where Handala allegedly claimed theft of 50 TB of data and wiping of more than 200,000 systems, servers, and mobile devices; Stryker confirmed a globally disruptive incident affecting its Microsoft environment.
Capabilities directly described in the content include irreversible wiping of data, rendering infected systems inoperable, rapid spread across networks, and evasion techniques. Splunk detection guidance highlights suspicious regasm processes, unauthorized AutoIt script execution, malicious driver drops, abrupt system slowdowns, and creation of unknown files or processes as indicators of Handala activity.
In Operation HamsaUpdate, Handala.exe is identified as a Delphi second-stage loader delivered by a Windows .NET loader disguised as F5UPDATER.EXE in a phishing campaign targeting Israeli customers using F5 BIG-IP vulnerability lures. In that chain, one ZIP variant drops Handala.exe from embedded resources into System32 and executes it. The Handala loader then spearheads execution of an AutoIt-based injector chain using a renamed AutoIt interpreter (Naples.pif) and an obfuscated script (k), which injects RC4-decrypting shellcode, decompresses payloads with LZNT1, and communicates over HTTPS with 31.192.237[.]207:2515. The broader campaign also deployed Windows and Linux wipers, though the Windows wiper itself is separately named Hatef and the Linux wiper Hamsa.
High-confidence infrastructure and behavioral details mentioned in the content include C2 communications to 31.192.237[.]207:2515, use of AutoIt execution, and in related campaign reporting, Telegram-based status reporting via Bot ID 6428401585:AAGE6SbwtVJxOpLjdMcrL45gb18H9UV7tQA and Chat ID 6932028002. Overall, the content characterizes Handala as a severe destructive threat capable of causing major disruption, downtime, financial loss, data loss, and potential exposure of sensitive information.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Stryker has suffered a major cyberattack involving wiper malware claimed by Handala, a pro-Palestinian hacktivist group linked to Iran.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniques
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
“obfuscated payload… concealed within… five Base64 encoding steps… executed using the ‘eval’ command.” / “loader conceals its strings with… ADD… AutoIt script… strings… SUB… shellcode… implements the RC4 stream cipher… decrypt another payload… decompressed… LZNT1.”
Discovery
1 technique
Discovery
Command and Control
1 technique
Command and Control
IOCs tracked for this family
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned disruptive tooling and operations involving data exfiltration and destructive actions against healthcare-related infrastructure.
Destructive malware used in attacks attributed to Handala to wipe Windows and Linux systems and disrupt operations; the group also claims data theft and public leaking of sensitive data.
A destructive wiper malware that irreversibly deletes data from infected systems, renders them inoperable, uses evasion techniques, and can spread rapidly across networks.
Delphi second-stage loader that runs an obfuscated script to enumerate/disable security tooling (via tasklist/findstr), reconstructs and launches a renamed AutoIt interpreter (Naples.pif) with an obfuscated AutoIt script (k). The AutoIt stage injects RC4-decrypting shellcode, decompresses (LZNT1), and executes further payloads, including code that communicates with a C2 over HTTPS (31.192.237[.]207:2515) and injects into multiple processes (e.g., dllhost.exe, Windows Media Player-related processes).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.