MrHex Hack-and-Leak Campaign Recycles Handala Data and Claims U.S. Industrial Attacks

DomainTools Intelligence identified an Iran-aligned hack-and-leak operation using the MrHex, @Mr8ex, MrDarkRoot, and @Darku3er personas to distribute and sell purported U.S. and Israeli records while targeting Israel, the United States, and Kurdish opponents. The operation uses dedicated leak websites, forums, and Telegram channels, including material recycled from earlier Handala and CyberAv3ngers leaks. Researchers documented explicit redistribution ties to Handala, but those links do not establish that the groups share operators.

MrHex also claimed attacks on U.S. critical infrastructure, and an associated video showed apparent access to an industrial human-machine interface. The industrial attack claims remain independently unverified, with no confirmed physical damage. The principal leak sites went offline on October 20, 2026, but no domain seizure was confirmed. For defenders, the findings warrant monitoring for exposed organizational data while distinguishing recycled leaks and access claims from verified new compromises or operational disruption.