Iran-Linked Handala Hack Wiper Campaign Against Israeli and U.S. Organizations

Handala Hack, an online persona tied to Void Manticore and assessed by multiple researchers as linked to Iran’s Ministry of Intelligence and Security (MOIS), is being tracked for destructive intrusions involving wiper attacks and related hack-and-leak activity against organizations in Israel and the United States. Public reporting cited by Unit 42 says attackers gained access to corporate networks using legitimate user credentials, while recent tradecraft includes phishing, identity compromise, and abuse of administrative access through Microsoft Intune. Israel’s National Cyber Directorate warned that several incidents involved deletion of servers and workstations to disrupt operations, reinforcing concern that the current regional conflict is increasing the likelihood of further destructive cyber activity.

Technical reporting indicates the actor continues to favor hands-on-keyboard operations, multiple wiping methods, and a mix of custom and publicly available tooling. Check Point said newly observed techniques include use of NetBird for tunneling and an AI-assisted PowerShell script for wiping, while Blackpoint’s advisory highlighted a broader Iranian threat posture featuring credential theft, phishing, password spraying, remote management tools, and exfiltration utilities such as Rclone. The combined reporting points to a near-term risk of disruptive attacks focused on identity compromise, lateral movement, data theft, and system destruction, particularly for organizations with exposed services, weak privilege controls, or insufficiently protected administrative accounts.