Loading malware…
Handala Wiper is a custom destructive malware family associated with the Iranian MOIS-linked threat cluster tracked as Handala, Void Manticore, Red Sandstorm, and Banished Kitten. It has been used in destructive operations against organizations in Israel, Albania, and the United States, including activity tied to the March 2026 Stryker incident. The malware is described as a Windows wiper and is also referenced alongside related aliases or variants including win.handala and Hamsa Wiper in broader Handala tooling discussions.
High-confidence reporting in the provided content describes Handala Wiper as being deployed through Group Policy logon scripts and scheduled tasks, including via a batch file named handala.bat, often executed from a Domain Controller so the payload is not necessarily written to disk on every endpoint. Its destructive behavior includes overwriting file contents and corrupting or overwriting the Master Boot Record (MBR) to cause deep system damage. In some incidents the executable was named handala.exe. The actor has also used the wiper in parallel with other destructive methods, including a PowerShell-based wiper that deletes user directories and drops handala.gif, VeraCrypt-based disk encryption, and manual deletion of files and virtual machines.
Historical malware-analysis context in the content links Handala Wiper to a staged delivery chain using an NSIS-packaged dropper, an obfuscated batch script, an AutoIt3 loader, and injection into regasm.exe. The tooling also reportedly used a vulnerable driver in a BYOVD-style technique for privileged file operations, specifically ListOpenedFileDrv_32.sys loaded via OpenFileFinder.dll, and leveraged Regasm.exe for .NET injection. The malware performed host and network reconnaissance, including collecting hostname, username, domain, disk space, and public IP address via icanhazip.com, and exfiltrated victim details and undeleted-file information to a Telegram bot used as command-and-control. Reported anti-analysis or evasion behavior included checks for security products and delayed execution.
The content attributes use of Handala Wiper to the Handala Hack persona within the broader Void Manticore ecosystem, assessed with high confidence as MOIS-affiliated. Reported intrusion tradecraft around deployment includes compromised VPN credentials, brute force or credential stuffing, RDP-based lateral movement, AD reconnaissance, credential dumping, and use of NetBird for tunneling before destructive impact. Relevant indicators and artifacts directly mentioned in the content include filenames handala.exe, handala.bat, handala.gif, use of Regasm.exe, the vulnerable driver ListOpenedFileDrv_32.sys, and infrastructure such as 107.189.19.52 and 82.25.35.25.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Historically they deployed the Handala Wiper, an NSIS-packaged dropper using an AutoIt3 loader, a vulnerable driver (BYOVD) for privileged file operations, and Regasm.exe for .NET injection. That toolchain is still in use elsewhere. At Stryker they skipped it entirely and used Intune.
The first is the custom Handala Wiper, distributed via Group Policy logon scripts through a batch file named handala.bat. This wiper overwrites file contents and applies Master Boot Record (MBR) corruption for deep, low-level damage.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“Spear Phishing Attachment (T1566.001) The phishing campaign utilizes a .PDF attachment to deceive users… The document contains a link… directs users to malicious software that wipes the compromised systems.”
Victims were directed to download a malicious archive containing a disguised installer that deployed a destructive wiper payload.
During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...
The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...
Handala campaigns typically use a staged execution chain designed to evade detection. Payload components are reconstructed at runtime and delivered through scripting frameworks before deploying the final wiper payload.
Handala Destructive Wiper detection involves monitoring for suspicious activities such as ... unauthorized AutoIt script executions ...
initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.
The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat.
During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...
The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts.
The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat.
During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping, distributed via Group Policy logon scripts and scheduled tasks...
The wiper was distributed across the network as a scheduled task using Group Policy logon scripts...
“Exploitation for Privilege Escalation BYOVD (T1068)… employs… ‘Bring Your Own Vulnerable Driver’ (BYOVD), utilizing a driver named ListOpenedFileDrv_32.sys… loaded as a service…”
Wipers are often pushed via GPO (e.g., handala.bat) so that the executable runs from the Domain Controller without being written to disk on every endpoint.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
Handala Destructive Wiper detection involves monitoring for suspicious activities such as ... the dropping of malicious drivers.
“Obfuscated Files or Information (T1027) …scatters garbage or invalid Windows commands among legitimate batch script instructions… effectively masks the true functionality of the script while allowing it to run as intended.”
Executables Or Script Creation In Temp Path ... T1036
Handala Destructive Wiper is a potent malware strain known for its destructive capabilities. It targets and irreversibly wipes data from infected systems, rendering them inoperable.
Handala Destructive Wiper detection involves monitoring for suspicious activities such as unexpected regasm processes...
“Time Based Evasion (T1497.003)… If these processes are not detected, the script instructs the system to pause execution for approximately 90 to 180 seconds by using the “ping -n” parameter.”
Wipers are often pushed via GPO (e.g., handala.bat) so that the executable runs from the Domain Controller without being written to disk on every endpoint.
“Time Based Evasion (T1497.003)… If these processes are not detected, the script instructs the system to pause execution for approximately 90 to 180 seconds by using the “ping -n” parameter.”
“Automated Exfiltration (T1020)… created a [Telegram] bot to serve as the C2… responsible for sending information from the compromised host…”
Handala Malware Capability: While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.
Handala Wiper (Rules 11–19) • ... VSS shadow wipe + reboot ...
Handala Malware Capability: While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.
During impact, Void Manticore combines multiple destructive methods: a custom Handala Wiper (sometimes handala.exe) with MBR-based wiping...
MITRE ATT&CK TTPs Tactic ID Technique Impact T1561.002 Disk Structure Wipe
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.