Loading story…
Iran-linked threat actor Handala sent threatening WhatsApp messages to U.S. service members at Naval Support Activity Bahrain, warning that they were under surveillance and could be targeted by drones and missiles. The operation was described as a psychological influence campaign delivered through personal communications channels rather than a conventional network intrusion, signaling a shift toward direct intimidation of military personnel.
Handala then claimed on Telegram that it had exposed personal data for 2,379 U.S. Marines serving in the Persian Gulf. Multiple reports tie the group to Iran's Ministry of Intelligence and Security and note a broader history of disruptive and espionage-linked activity, including attacks on Stryker, compromise of FBI Director Kash Patel's personal Gmail account, and operations using phishing, wipers, Telegram-based command and control, and abuse of cloud administration tools such as Microsoft Intune factory resets.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
On the following day, Handala posted on Telegram claiming it had exposed personal information for 2,379 U.S. Marine Corps members serving in the Persian Gulf. The claim represented an escalation from threatening messages to alleged disclosure of service members' personal data.
On 2026-04-28, U.S. service members stationed at Naval Support Activity Bahrain received WhatsApp messages attributed to Handala warning they were under surveillance and could be targeted by drones and missiles. The operation marked a shift toward direct psychological targeting of military personnel through personal communications channels.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026
Recorded Future assesses that Iran’s Ministry of Intelligence (**MOIS**) is using the **Handala** name as a reusable operational brand spanning cyber, influence, espionage, and now physical threat activity. The report links **Handala Hack Team**, **Handala Popular Resistance Front (HPRF)**, **VIPEmployment**, **MOISIRAN**, and **Brave Israel** to a broader MOIS-associated cluster tied to **Void Manticore**, which has historically targeted Israel, Iranian opposition groups, and increasingly the United States. Handala Hack Team has been associated with hack-and-leak campaigns, wiper activity, and psychologically oriented ransomware operations. Newer Handala-linked personas are described as focusing on proxy recruitment, intimidation, surveillance, and claims of real-world attacks inside Israel. Recorded Future said Telegram channels and bots, including **VIPEmployment**, were used to solicit recruits for espionage, sabotage, and attacks against U.S. and Israeli interests, while **HPRF** claimed responsibility for a vehicle arson attack in Israel in April 2026, marking the first overt physical attack publicly claimed under the Handala banner. The firm warned that MOIS is likely to continue blending cyber and physical operations against Israeli and U.S. targets, viewing such activity as remaining below the threshold of armed conflict.
Jun 29, 2026
A pro-Iranian hacking group calling itself **Handala** claimed responsibility for compromising a personal account belonging to FBI Director **Kash Patel** and posted what appeared to be old personal photographs, a résumé, and other personal documents online. The FBI said malicious actors targeted Patel’s personal email information and that it had taken mitigation steps, adding that the exposed material was historical and did not include government information. Reporting said Patel had previously been notified by the FBI in December 2024 that he was a target of an Iranian hacking operation before he became FBI director. U.S. authorities have described Handala as a pro-Iranian, pro-Palestinian proxy actor linked to prior operations against U.S. officials, and the government is offering up to **$10 million** for information that helps identify the group’s members; the group has also recently claimed responsibility for disrupting **Stryker** systems.
Jun 29, 2026