The Iranian state-linked threat group known as Handala Hack is intensifying its cyber operations, launching aggressive data-wiping attacks against international organizations. According to security researchers, the group also tracked as Void Manticore is believed to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS) and is increasingly targeting enterprises beyond its traditional regional focus.

Handala Hack operates through multiple online personas, including Homeland Justice, which has targeted government and telecom sectors in Albania, and Karma. Over time, “Handala Hack” has emerged as its primary public identity, claiming responsibility for attacks in Israel and more recently expanding to U.S.-based organizations such as Stryker.

Unlike more advanced threat groups that rely on sophisticated malware frameworks, Handala Hack favors manual intrusion techniques. The group typically gains initial access through compromised VPN credentials or by exploiting vulnerabilities in IT service providers. Researchers have also observed the use of Remote Desktop Protocol (RDP) and tools like NetBird to establish and maintain access within victim networks.

In a notable shift, attackers have been seen connecting via Starlink IP addresses as well as directly from Iranian infrastructure, suggesting changes in their operational security approach. Once inside a network, the group uses legitimate zero-trust networking tools to create encrypted communication channels, enabling persistent access and coordinated attack execution.

The primary objective of Handala Hack is maximum operational disruption. Rather than focusing solely on data theft, the group emphasizes destruction, often combining wiping attacks with “hack-and-leak” tactics. During the final phase of an attack, multiple wiping methods may be deployed simultaneously across the network. Using Windows Group Policy, attackers distribute malicious payloads at scale to ensure widespread impact.

Key techniques include:

  • Custom Handala Wiper: A malicious executable that overwrites files and targets the master boot record (MBR), rendering systems inoperable and causing permanent data loss.

  • AI-assisted PowerShell scripts: Automated tools that scan and delete files across user directories, sometimes leaving behind propaganda images as part of the attack.

These coordinated actions can cripple entire IT environments, making recovery extremely difficult without secure backups. Despite the severity of these attacks, the group’s reliance on relatively straightforward methods provides opportunities for defense. Organizations can significantly reduce risk by strengthening credential security, including enforcing multi-factor authentication and monitoring for compromised accounts.

Continuous network monitoring is also essential to detect unusual login patterns, unauthorized remote access, or abnormal use of administrative tools. Limiting access to critical systems and implementing least-privilege policies can further reduce the potential impact of a breach.

Regular offline backups remain a critical safeguard, ensuring that data can be restored even in the event of destructive attacks. As Handala Hack continues to expand its reach and refine its tactics, organizations must remain vigilant. Strengthening identity security, improving visibility into network activity, and preparing for destructive scenarios are key to defending against this increasingly aggressive threat actor.

Recommended Cyber News:

To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com