Iran-Linked Handala Used VPN Access, RDP, NetBird, and Wipers in Destructive Campaign

Researchers linked Handala Hack to Iran’s Ministry of Intelligence and Security as part of the broader Void Manticore cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on Stryker, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity.

Investigators said the intrusions commonly began with compromised VPN credentials, followed by hands-on-keyboard movement over RDP, use of NetBird for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom Handala Wiper, PowerShell-based wiping, VeraCrypt encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including Homeland Justice and Karma, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.