\n<\/p>\n
The U.S. Justice Department accused Iran\u2019s government of being behind the hacktivist group Handala, which last week claimed responsibility for the destructive cyberattack<\/a> against the U.S. medical tech giant Stryker.\u00a0<\/p>\n In a press release<\/a> published on Thursday, the Justice Department said Iran\u2019s Ministry of Intelligence and Security (MOIS) is operating Handala.\u00a0<\/p>\n The Justice Department called the group a fake activist persona that the Iranian ministry used to carry out \u201cpsychological operations\u201d against the regime\u2019s enemies, to claim responsibility for cyberattacks, and to publish stolen information obtained during those hacks. The group also called for the killing of journalists, regime dissidents, and Israeli persons, per the DOJ.\u00a0<\/p>\n The announcement came hours after the FBI seized two websites linked to Handala<\/a>, as first reported by TechCrunch. The group used the websites to publicize its alleged cyberattacks, as well as to publish the personal information of dozens of people who allegedly worked for the Israeli military and defense contractors.\u00a0<\/p>\n Handala took credit on its website for the March 11 cyberattack on Stryker, during which the hackers remotely wiped tens of thousands of employee devices<\/a>. The hackers said the breach was in retaliation for a U.S. air strike on an Iranian school, which killed 168 children, according to Iranian officials<\/a>.<\/p>\n FBI director Kash Patel was quoted in the DOJ\u2019s press release as saying that the FBI \u201ctook down four of their operation\u2019s pillars and we\u2019re not done.\u201d<\/p>\n Apart from the two websites used by Handala, the DOJ also seized two other domains allegedly used by Iran\u2019s MOIS via another hacktivist persona calling themselves \u201cJustice Homeland\u201d or \u201cHomeland Justice.\u201d The DOJ accused Iranian government hackers of using those two domains to claim responsibility for hacking the Albanian government in 2022, in a cyberattack that resulted in government servers being taken offline and the theft of sensitive data. Microsoft also linked the attack<\/a> against the Albanian government to the MOIS.<\/p>\n In an affidavit<\/a> submitted in court to support the seizure of Handala\u2019s websites, the FBI said that Handala, Justice Homeland, and another hacktivist persona called Karma Below, \u201care part of the same conspiracy because they are operated by the same individuals.\u201d<\/p>\n \t\t\tDo you have more information about Handala, or other Iran-linked hacking operations? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email<\/a>.<\/a> \t\t<\/div>\n Handala responded to the DOJ\u2019s announcement in a statement posted on its official Telegram channel, where the hackers called the U.S. government actions \u201cnothing more than the latest desperate attempts by the United States and its allies to silence the voice of Handala.\u201d<\/p>\n DomainTools\u2019 cybersecurity researcher Keith O\u2019Neill told TechCrunch that Handala has already set up new domains that have not yet been seized.<\/p>\n The hacking group did not respond to a request for comment sent to a chat account publicized by the hackers, as well as an email address identified by the Justice Department in its affidavit.\u00a0<\/p>\n A spokesperson for Iran\u2019s Permanent Mission to the United Nations did not respond to TechCrunch\u2019s request for comment. Stryker also did not respond to a request for comment.<\/p>\n Alex Orleans, the head of threat intelligence at Sublime Security who has tracked Iranian hackers for years, told TechCrunch that it is possible that the people behind the Handala persona are not the same individuals doing the actual hacking.\u00a0<\/p>\n \u201cHandala does not necessarily equate, one-to-one, with the actors conducting the activities it\u2019s taking credit for,\u201d said Orleans. \u201cThere could be multiple teams conducting actual intrusions while a distinct team is responsible for maintaining the persona \u2014 with all of these distinct elements coexisting within a larger unified MOIS element.\u201d<\/p>\n \u201cThere\u2019s a level of opacity there that can be difficult to penetrate,\u201d he said.<\/p>\n<\/div>\nContact Us<\/h4>\n