Loading story…
Handala Hack published a propaganda statement tying its future cyber operations to the death of Ali Larijani, portraying him as a martyr and vowing revenge against Israel. The message says every Handala operation will be carried out in his memory, frames upcoming attacks as part of a broader "Axis of Resistance" campaign, and explicitly threatens that Israeli targets and their supporters will face further cyberattacks.
Reporting from El Mundo describes Larijani's death in a separate but related geopolitical context, saying Israel has been conducting a campaign to decapitate Iran's leadership and command structure through deep intelligence penetration, including cyber capabilities alongside human, signals, and satellite intelligence. That article provides background on the killing of Larijani and other Iranian officials, but it is not primarily about Handala's cyber activity; it is relevant only as context for the death that Handala is using to justify and publicize retaliatory cyber threats.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On its website, Handala published a propaganda statement framing its cyber operations as revenge inspired by 'Martyr Ali Larijani.' The group threatened continued attacks against 'Zionists and their masters' and linked its campaign to broader Axis of Resistance messaging.
In retaliation, Iran reportedly launched a ballistic missile carrying cluster munitions that killed two civilians in Ramat Gan near Tel Aviv. The article presents this as part of the parallel escalation during the Israel-Iran confrontation.
After the initial offensive, Israel reportedly broadened its objectives from degrading Iran's missile and nuclear capabilities to undermining regime continuity and internal repression. El Mundo says subsequent strikes in Tehran killed senior figures including Intelligence Minister Esmail Khatib, Ali Larijani, and Basij commander Gholamreza Soleimani, aided by precise intelligence and local sources.
According to the El Mundo report, Israel began its campaign against Iran on 2026-02-28 with an initial strike that allegedly killed Supreme Leader Ali Khamenei. The article says the operation also included sabotage and drone attacks by Mossad-linked networks against Iranian air defenses and missile launchers at the outset.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded Future assesses that Iran’s Ministry of Intelligence (**MOIS**) is using the **Handala** name as a reusable operational brand spanning cyber, influence, espionage, and now physical threat activity. The report links **Handala Hack Team**, **Handala Popular Resistance Front (HPRF)**, **VIPEmployment**, **MOISIRAN**, and **Brave Israel** to a broader MOIS-associated cluster tied to **Void Manticore**, which has historically targeted Israel, Iranian opposition groups, and increasingly the United States. Handala Hack Team has been associated with hack-and-leak campaigns, wiper activity, and psychologically oriented ransomware operations. Newer Handala-linked personas are described as focusing on proxy recruitment, intimidation, surveillance, and claims of real-world attacks inside Israel. Recorded Future said Telegram channels and bots, including **VIPEmployment**, were used to solicit recruits for espionage, sabotage, and attacks against U.S. and Israeli interests, while **HPRF** claimed responsibility for a vehicle arson attack in Israel in April 2026, marking the first overt physical attack publicly claimed under the Handala banner. The firm warned that MOIS is likely to continue blending cyber and physical operations against Israeli and U.S. targets, viewing such activity as remaining below the threshold of armed conflict.
Jun 29, 2026
The main event is **Handala Hack's claimed compromise of Mossad-linked personnel and systems**, including an alleged leak of more than **50,000 confidential emails and documents** tied to **Ilan Steiner**, described as a former Mossad budget director and current CFO of Israel’s National Security Institute. The post frames the material as exposing financial flows, operational planning, research activity, and support networks allegedly connected to Israeli intelligence operations across the region. This is **not fluff**: despite the propagandistic tone and lack of independent verification in the source material, it is a concrete claim of a cyber intrusion and data leak with potential intelligence and security implications. A second Handala post appears related to the same broader campaign, naming **Mir Vahid Hassantabar** ("Vahid Online") and his brother **Navid Hassantabar** as alleged Mossad-linked actors and claiming the group identified the team's geographic location and prior involvement in cyber sabotage against an Iranian bank. That reference is relevant because it fits the same Handala operation targeting alleged Israeli or anti-Iranian networks, though it is more of a doxing/accusation post than a direct technical disclosure. The Substack article about British and American information operations in Libya is **not** about the same incident and should be excluded as a separate historical intelligence story.
Jun 29, 2026
The Iranian-linked **Handala** group claimed it had disrupted Israeli radar systems and placed the Kfar Yona municipality under a “cyber siege” amid renewed Iran-Israel hostilities. Reporting on the incident found that the evidence released by the group does **not** substantiate a radar intrusion: the screenshots and access shown appear to match a **Tadiran Telecom Aeonix** IVR/VoIP administration panel, suggesting compromise of a municipal or organizational phone system rather than military radar infrastructure. Researchers said the operation fits a broader pattern in which cyber activity is used to amplify battlefield messaging during escalating regional conflict involving Hezbollah fire, Israeli strikes in Beirut, IRGC missile launches, and Israeli retaliatory strikes on Tehran, Tabriz, and Isfahan. While the specific radar-disruption claim bears the hallmarks of propaganda and remains uncorroborated by independent evidence or official acknowledgment, Handala is described as a real state-affiliated threat actor with documented capabilities including credential theft, abuse of legitimate enterprise tools, wiper malware, and hack-and-leak operations, raising the likelihood of further disruptive attacks and inflated claims.
Jun 29, 2026