Handala
Handala presents itself as a pro-Palestinian hacktivist group. The US Department of Justice links it to Iran's Ministry of Intelligence and Security, and MITRE and Check Point treat it as a persona of the Void Manticore cluster. It combines destructive attacks, data leaks and intimidation.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
US authorities link the persona to the Iranian state. On 19 March 2026 the US Department of Justice announced the seizure of four domains it described as controlled by Iran's Ministry of Intelligence and Security. It said they were used to claim hacks, publish stolen data, threaten people and call for violence against journalists, dissidents and Israeli people.2
On 11 March 2026, the Handala persona claimed a destructive attack on a US medical technology firm.2 BleepingComputer reported, citing a source familiar with the incident, that attackers compromised an administrator account and used Microsoft Intune's own wipe command against devices. CISA then told US organisations to harden endpoint management systems.5 That is a lesson for any organisation: admin tools can be as damaging as malware.
The UK link is indirect. The NCSC, FBI and Dutch AIVD say Iranian state actors have used CHOSEN BRICK malware against individuals including in the UK, but their advisory does not name Handala.6 The Hacker News reports that Group-IB ties the related HEAVYGRAM backdoor to Handala, and that the NCSC tracks the same family as CHOSEN BRICK.3 In March 2026, the NCSC said it saw no significant change in the direct threat from Iran to the UK, but that this could change.7 The sources reviewed do not establish a UK organisation as a Handala victim.
Do not let a hacktivist label set your assumptions: there may be no ransom to pay and no way to negotiate. We would treat admin consoles such as Intune as critical systems. Organisations with links to Israel, the Middle East or the US, or staff who may interest the Iranian state, may want to pay particular attention.
How It Attacks
Based on Check Point Research's account of destructive intrusions4 and BleepingComputer's report of the Intune case.5
- 1
Get In
Uses compromised VPN accounts, brute force attempts and IT or service providers. Access may be established months in advance.
- 2
Gather Credentials
Dumps LSASS, exports registry hives and maps Active Directory with ADRecon.
- 3
Move Laterally
Moves widely over RDP and installs NetBird to reach hosts that are not directly accessible.
- 4
Prepare for Destruction
Disables Windows Defender and uses Group Policy or a domain controller to distribute wipers.
- 5
Wipe and Encrypt
Runs custom wipers, encrypts drives with VeraCrypt, deletes virtual machines and files by hand, and has reportedly abused Intune's wipe command.
- 6
Claim and Intimidate
Claims credit online, publishes stolen data and threatens individuals.
Key Techniques
Selected from the VOID MANTICORE entry in ATT&CK v20.1 Handala is one persona in that entry, so not every technique will apply to every Handala operation.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1133 | External Remote Services | Initial Access | Uses public-facing VPN infrastructure. |
| T1199 | Trusted Relationship | Initial Access | Targets IT and service providers for credentials. |
| T1684.001 | Impersonation | Stealth | Poses as known contacts and app support staff. |
| T1003.001 | LSASS Memory | Credential Access | Dumps LSASS credentials. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves across networks over RDP. |
| T1484.001 | Group Policy Modification | Defence Impairment | Distributes payloads with logon scripts. |
| T1102 | Web Service | Command and Control | Uses the Telegram API for control. |
| T1651 | Cloud Administration Command | Execution | Abuses built-in remote wipe commands in cloud management. |
| T1561.002 | Disk Structure Wipe | Impact | Deploys wipers that overwrite the MBR. |
| T1485 | Data Destruction | Impact | Wipes data and deletes files by hand. |
Tools Observed
Destructive
Discovery and Access
Surveillance Malware
Destructive and access tools are from Check Point.4 HEAVYGRAM and CRUDEEXCLUDE are from Group-IB's work as reported by The Hacker News.3 VeraCrypt and NetBird are legitimate products.
Key Events
Void Manticore is active from at least this period. The Homeland Justice persona claims theft from Albanian government bodies in 2022.1,2
Handala claims a destructive attack on a US medical technology firm.2
CISA warns US organisations to harden endpoint management systems.5
The US Department of Justice announces the seizure of four domains.2
The FBI warns that Handala used Telegram to control malware against journalists and dissidents.8
The NCSC, FBI and AIVD publish a joint advisory on CHOSEN BRICK,6 and Group-IB's HEAVYGRAM link to Handala is reported.3
Warning Signs
From Check Point's monitoring advice4 and the joint advisory.6 None of these proves an attack alone.
- VPN logons from unfamiliar countries, or failed logons followed by success
- New device registrations
- RDP from default Windows hostnames, especially out of hours
- NetBird, RMM or SSH tunnelling tools you do not recognise
- New Group Policy logon scripts or scheduled tasks
- A new Global Administrator account or mass wipe commands in Intune
Defences That Matter
Protect Remote Access
- Enforce MFA, especially for remote access and privileged accounts.4
- Consider limiting VPN access to business-relevant countries.4
- Restrict or disable RDP.4
Lock Down Admin Consoles
- Apply least privilege through Intune role-based access.5
- Require a second administrator to approve device wipes.5
- Alert on new Global Administrators.
Support Staff at Risk
- Use phishing-resistant MFA and application allowlisting.6
- Share the advisory with staff likely to be targeted, and help them check personal devices.6
Plan for Destruction
- Keep offline backups that admin consoles cannot reach.
- Rehearse a response where there is no ransom to negotiate.
What Could One Admin Account Wipe?
We can review your admin consoles, remote access and recovery plans against the methods in this profile.
Sources
- MITRE ATT&CK: VOID MANTICORE (G1055), ATT&CK v20
- US Department of Justice: Justice Department Disrupts Iranian Cyber Enabled Psychological Operations, 19 March 2026
- The Hacker News: Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords, 17 September 2026
- Check Point Research: Handala Hack: Unveiling Group's Modus Operandi, 12 March 2026
- BleepingComputer: CISA urges US organisations to secure Microsoft Intune systems, 19 March 2026
- NCSC, FBI and AIVD: Iranian cyber targeting of dissidents, activists and journalists, 15 September 2026
- BleepingComputer: UK warns of Iranian cyberattack risks amid Middle-East conflict, 2 March 2026
- BleepingComputer: FBI warns of Handala hackers using Telegram in malware attacks, 23 March 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.