Loading threat actor…
Handala is an Iranian state-linked cyber threat persona associated with Iran’s Ministry of Intelligence and Security (MOIS). Also known as Handala Hack, Handala Hacking Team, and Handala Popular Resistance Front, it is operated by the actor tracked as Void Manticore, Banished Kitten, Red Sandstorm, and Storm-0842. Homeland Justice is a related persona associated with the same operational organization. Handala emerged publicly in late 2023 under a pro-Palestinian hacktivist identity. It primarily targets Israeli government bodies, critical infrastructure, and private-sector organizations, with additional targeting of United States organizations and officials. Its operations combine unauthorized access, data theft and publication, disruptive attacks, and psychological warfare. Documented techniques include phishing, credential-based intrusion, distributed denial-of-service attacks, and abuse of centralized administration infrastructure. It maintains public-facing leak channels and uses politically framed disclosures and exaggerated impact claims to intimidate targets and influence public perceptions. In January 2025, Handala compromised an Israeli security vendor’s centralized management infrastructure and used connected public-address systems in approximately 20 kindergartens to broadcast fake emergency alerts and propaganda. In March 2026, it published historical personal material from FBI Director Kash Patel’s email account; the FBI acknowledged the targeting and stated that the material contained no government information. These operations illustrate its emphasis on combining technical compromise with highly visible information operations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
185 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
36 malware families Mallory has associated with this actor across public reporting.
31 additional families tracked in Mallory.
9 CVEs Mallory has associated with this actor across public reporting. 9 of them are exploited in the wild (not necessarily by this actor).
3 more CVEs tied to this actor tracked in Mallory.
273 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.