Iran-Linked Handala Brand Expands From Cyber Operations to Physical Threats

Recorded Future assesses that Iran’s Ministry of Intelligence (MOIS) is using the Handala name as a reusable operational brand spanning cyber, influence, espionage, and now physical threat activity. The report links Handala Hack Team, Handala Popular Resistance Front (HPRF), VIPEmployment, MOISIRAN, and Brave Israel to a broader MOIS-associated cluster tied to Void Manticore, which has historically targeted Israel, Iranian opposition groups, and increasingly the United States. Handala Hack Team has been associated with hack-and-leak campaigns, wiper activity, and psychologically oriented ransomware operations.

Newer Handala-linked personas are described as focusing on proxy recruitment, intimidation, surveillance, and claims of real-world attacks inside Israel. Recorded Future said Telegram channels and bots, including VIPEmployment, were used to solicit recruits for espionage, sabotage, and attacks against U.S. and Israeli interests, while HPRF claimed responsibility for a vehicle arson attack in Israel in April 2026, marking the first overt physical attack publicly claimed under the Handala banner. The firm warned that MOIS is likely to continue blending cyber and physical operations against Israeli and U.S. targets, viewing such activity as remaining below the threshold of armed conflict.