Inside the Tehran-Linked ‘Faketivist’ Hacking Group Handala

A Iranian hacking group that took credit for hacking a medical device manufacturer and a payment processing device maker has a history of wiper attacks, hack-and-leak campaigns and advancing Tehran’s agenda through psychological operations.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Going by the moniker “Handala,” the group appears to be run out of Iran’s Ministry of Intelligence, according to cybersecurity threat intel sources who track it under a variety of names, including Banished Kitten, Storm-0842 and Void Manticore.

Check Point Software in a Tuesday report said the Iranian nation-state hacking group Void Manticore “is one of the most active groups pursuing strategic objectives through cyber operations” on behalf of the regime.

Now, Handala is being used to support Tehran’s response to attacks by the United States and Israel against Iran that began Feb. 28 (See: Medtech Firm Stryker Disrupted by Pro-Iran Hackers).

Gary Warner, director of threat intelligence at DarkTower, said in a post to LinkedIn that Handala “is in a different class” from the myriad hacktivist groups responding to the conflict.

Like many nation-state hacking groups, Handala likely often prepositions itself inside a victim’s environments, only unleashing an attack when it’s useful.

In the case of Michigan-based medical device manufacturer Stryker, experts said attackers appear to have gained access to its Active Directory infrastructure – when isn’t clear – and used the Microsoft Intune endpoint management tool on Wednesday to remotely wipe devices and servers.

“Given what we know about this particular attack, businesses should inspect all Intune job creations and consider restricting access as appropriate,” said Cynthia Kaiser, senior vice president at anti-ransomware firm Halcyon, in a LinkedIn post.

Stryker wrote Wednesday in a regulatory disclosure for investors that the timeline for full restoration of its systems “is not yet known.” The company said it invoked “continuity measures in place to continue to support its customers and partners.”

On Thursday morning, the company said it believes the attack has been “contained.”

Handala’s focus on the healthcare sector isn’t new. “The Handala threat actor has historically focused on Israeli government, defense and critical infrastructure targets, including healthcare. Over the past year, however, the group has expanded its targeting to include Gulf States,” said Ismael Valenzuela, vice president of threat intelligence at Arctic Wolf.

He expects to see further targeting of U.S. firms, including companies with ties to Israel or Israeli supply chains.

What other victims Handala may have already amassed or might be targeting isn’t clear.

Cybersecurity experts said attacks such as the one against Stryker carry symbolic weight. “It’s like going after water plants, and power plants – those sustain life. So the attackers are going after that as a symbol as opposed to ‘is it the best thing to go after,'” Jeff Thomas, CTO of Sentara Health, told Information Security Media Group.

“It’s the concept of if you want to hurt them, you take out something that’s life-sustaining,” he said.

Handala outsources at least some of its operations, including hack attacks as well as physical surveillance. Threat intelligence firm FalconFeeds.io said in a Friday report that the group, which it describes as a “faketivist” operation, in October 2025 launched the crowdsourced handala-redwanted.to platform, registered using a Tonga top-level domain name, which offers bounties to individuals who deliver on cyberespionage targets.

The portal details desired data for doxxing purposes, as well as wanted targets – seeking their personal information – with a maximum reward of $50,000 as of January for “tier one” or “high-value intelligence targets,” including Israeli signals intelligence officers from Mossad, Israel’s national intelligence agency.

“The bounty system creates a direct and credible threat of targeted violence, kidnapping, or assassination attempts against named individuals,” with the high monetary value of the bounty likely serving as motivation for the likes of “organized criminal groups, ideologically motivated individuals or foreign intelligence proxies” to participate, FalconFeeds.io said.

As of this month, the researchers said the list of targets on the high-uptime portal has expanded to include Israeli Military Intelligence, abbreviated as Aman, as well as a range of senior military officers, “operatives allegedly from Mossad’s Iran desk” plus “senior government officials,” and that targets are “continuing to be published amid the current Iran-Israel military escalation cycle.”

Communications between platform users and operators are encrypted, and it’s not clear how, or if, they’ve been paid, although presumably transactions occur in cryptocurrency.

Threat intelligence firm Flashpoint reported late Wednesday that “the conflict has shifted from a purely military engagement to a total economic and technological war.”

On Wednesday, the Islamic Revolutionary Guard Corps, one of Iran’s military branches, announced that American technology giants – including Amazon, Google, Microsoft, Nvidia, Oracle and Palantir – as well as banks – are now considered military targets. It advised civilians to stay at least a half mile away from any listed bank branches within missile or drone range.

In response, HSBC told customers in Qatar that it is temporarily closing all branches. Western banks with branches in Kuwait and the United Arab Emirates may follow suit.

Iran’s attacks against oil refineries, blockade of the Strait of Hormuz and attacks against multiple merchant ships on Wednesday sent the price of a barrel of oil over $100 on Thursday – after it spiked above $120 earlier in the week – even after the United States said it would release 172 million barrels from the country’s strategic reserve.

U.S. President Donald Trump recently said the conflict will be over “soon.” He’s shared no more detailed timeline.

“We don’t want to go back every two years. We’re going to finish the job,” he told supporters inside a Kentucky packing plant on Wednesday, reported the Guardian.

As part of Iran’s strategy for pressuring the U.S. to end the conflict, its cyberattacks appear to be staying carefully outside perceived red lines – such as destructive attacks against U.S. critical infrastructure – while still targeting Trump and America’s economy, said Ian Thornton-Trump, CISO of cybersecurity firm Inversion6.

“Trump is very unpopular, Iran can make him more unpopular by forcing the price of oil – the impacts of which manifest in nearly every consumable product in the U.S. – up, way up,” he said.

“The cost of war in the Middle East is found at the gas pump,” he said.

With reporting from Information Security Media Group’s Marianne Kolbasuk McGee from the HIMSS Conference in Las Vegas.