Loading story…
Lockheed Martin is facing extortion claims from the pro-Iran hacktivist group APT Iran, which said it stole 375 TB of data from the U.S. defense contractor, including alleged F-35 aircraft blueprints and other internal corporate files. The group publicized the alleged breach on Telegram and demanded more than $400 million to keep the material from being sold to U.S. adversaries, according to reporting cited by SC Media, Cybersecurity Dive, and UpGuard.
A web archive of a post attributed to the Handala Hack Team showed the attackers escalating pressure by giving Lockheed Martin employees 48 hours to respond. Lockheed Martin said it was aware of the reports and maintained that it has multilayered security controls in place, adding that it remains confident in the integrity of its information systems and data security. Flashpoint also linked the same threat actor to earlier attacks on Jordanian critical infrastructure, underscoring broader regional and geopolitical risk tied to the campaign.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
A web-archived post on the Handala Hack Team site stated that Lockheed Martin employees had been given 48 hours to respond. The post indicated continued pressure activity tied to the alleged breach and extortion campaign.
Lockheed Martin acknowledged awareness of the reported incident and said it maintains multilayered security measures and policies. The company also said it remained confident in the integrity of its information systems and data security.
Alongside its breach claim, APT Iran said it wanted more than $400 million in ransom to avoid selling the purportedly stolen Lockheed Martin data to U.S. adversaries. This marked an escalation from a theft claim to an extortion threat.
The pro-Iran hacktivist collective APT Iran publicly claimed it had breached Lockheed Martin and stolen 375 TB of data, including alleged F-35 aircraft blueprints and other corporate files. The claim was publicized on Telegram and became the basis for subsequent reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourcescworld.com
Open sourceupguard.com
Open sourcecybersecuritydive.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked hackers operating as the **Handala Hack Team** claimed they breached FBI Director Kash Patel’s personal Gmail account and published excerpts from the stolen material online. Reporting says the leak totaled about **800 MB** and included personal photographs, a purported resume, and hundreds of emails, with exposed correspondence spanning roughly **2010 to 2019** and appearing to contain both personal and work-related messages. A Justice Department official confirmed Patel’s email account had been compromised and said the leaked material appeared authentic, though the emails themselves were not independently verified. Handala framed the intrusion as an embarrassment for U.S. security leadership and warned that if the FBI director could be compromised, other personnel could be targeted as well. Western cybersecurity researchers have assessed Handala as a pro-Palestinian hacktivist persona linked to **Iranian government cyberintelligence units**, and the breach follows other activity attributed to the group, including a claimed attack on medical technology company **Stryker**. The incident also comes after U.S. actions against Handala, including domain seizures and a **$10 million** reward offer tied to identifying members of the group.
Jun 29, 2026
An Iran-linked hacktivist group identified as **Nasir Security**, also known as **Nasir Resistance**, has allegedly leaked data stolen during a months-long breach of **Dubai International Airport**. Reports say the exposed material includes passport images belonging to Americans, Arabs, and Emiratis, along with photos of luggage contents and airport security scanner images. No confirmed evidence has emerged that airport operational systems or intelligence data were exposed, but the leaked personal records could be used for **identity theft**, fraud, and targeting of travelers. The intrusion was reported amid a broader escalation in regional cyber activity following U.S.-Israel strikes against Iran, with researchers linking the campaign to a wider pattern of Iranian cyber operations. Separate reporting also noted activity by the Iranian state-backed group **Seedworm**, which has reportedly compromised multiple organizations, including a U.S. bank and another airport, underscoring concerns that transportation infrastructure and traveler data are becoming focal points in the expanding cyber conflict.
Jun 29, 2026
**Handala Hack**, an online persona tied to **Void Manticore** and assessed by multiple researchers as linked to Iran’s **Ministry of Intelligence and Security (MOIS)**, is being tracked for destructive intrusions involving **wiper attacks** and related hack-and-leak activity against organizations in **Israel** and the **United States**. Public reporting cited by Unit 42 says attackers gained access to corporate networks using legitimate user credentials, while recent tradecraft includes phishing, identity compromise, and abuse of administrative access through **Microsoft Intune**. Israel’s National Cyber Directorate warned that several incidents involved deletion of servers and workstations to disrupt operations, reinforcing concern that the current regional conflict is increasing the likelihood of further destructive cyber activity. Technical reporting indicates the actor continues to favor **hands-on-keyboard** operations, multiple wiping methods, and a mix of custom and publicly available tooling. Check Point said newly observed techniques include use of **NetBird** for tunneling and an **AI-assisted PowerShell** script for wiping, while Blackpoint’s advisory highlighted a broader Iranian threat posture featuring credential theft, phishing, password spraying, remote management tools, and exfiltration utilities such as **Rclone**. The combined reporting points to a near-term risk of disruptive attacks focused on identity compromise, lateral movement, data theft, and system destruction, particularly for organizations with exposed services, weak privilege controls, or insufficiently protected administrative accounts.
Jun 29, 2026