Handala
Not a Ransomware Group
Victims
176
First Discovered
2024-05-26
victim
Last Discovered
2026-04-08
victim
Inactive Since
112
days
Avg Delay
12.3
days
Infostealer
64.3%
victims with domain
Countries
17
hit
Attack Velocity — Last 12 months
Known Locations (5)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Redirecting... | Yes | 2026-07-29T18:56:58 |
handala.to
|
|||
|
This Website Has Been Seized | Yes | 2026-07-29T18:58:03 | cloudflare |
handala-hack.to
|
||
|
No | 2026-04-29T09:35:24 |
vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd.onion
|
||||
|
Error Response Page | No | 2026-05-01T14:05:16 |
handala-team.to
|
|||
|
Security Verification | Yes | 2026-07-29T18:57:31 | TencentEdgeOne |
handala-hack.tw
|
Target
Top 5 Activity Sectors
- Technology 38
- Government & Defense 35
- Other 13
- Energy & Utilities 10
- Healthcare 8
Top 5 Countries
-
Israel
70
-
United States
9
-
Iran, Islamic Republic of
4
-
Palestine, State of
2
-
United Arab Emirates
2
Heatmap
TTPs Matrix (15)
| Initial Access | Execution | Persistence | Privilege Escalation | Stealth | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Impact | Resource Development | Reconnaissance | Defense Impairment |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Valid Accounts | Valid Accounts | Obfuscated Files or Information: Compression | OS Credential Dumping: LSASS Memory | System Information Discovery | Remote Services: Remote Desktop Protocol | Data from Local System | Exfiltration Over C2 Channel | Application Layer Protocol: Web Protocols | Data Destruction | Acquire Infrastructure: Domains | Gather Victim Identity Information | Domain or Tenant Policy Modification: Group Policy Modification |
| Valid Accounts: Domain Accounts | Command and Scripting Interpreter: PowerShell | Valid Accounts: Domain Accounts | Valid Accounts: Domain Accounts | Masquerading: Masquerade Task or Service | Brute Force | Account Discovery: Domain Account | Software Deployment Tools | Data Staged | Web Service | Data Encrypted for Impact | Acquire Infrastructure: Virtual Private Server | Active Scanning: Vulnerability Scanning | Disable or Modify System Firewall: Windows Host Firewall | |
| Valid Accounts: Cloud Accounts | Command and Scripting Interpreter: Python | Valid Accounts: Cloud Accounts | Valid Accounts: Cloud Accounts | Masquerading: Match Legitimate Resource Name or Location | Brute Force: Password Guessing | Screen Capture | Ingress Tool Transfer | Inhibit System Recovery | Acquire Infrastructure: Server | |||||
| External Remote Services | Software Deployment Tools | Account Manipulation | Account Manipulation | Valid Accounts | Brute Force: Credential Stuffing | Email Collection: Remote Email Collection | Remote Access Tools: Remote Desktop Software | Disk Wipe: Disk Content Wipe | Acquire Infrastructure: Web Services | |||||
| Exploit Public-Facing Application | User Execution: Malicious File | External Remote Services | Domain or Tenant Policy Modification: Group Policy Modification | Valid Accounts: Domain Accounts | Unsecured Credentials: Credentials in Registry | Automated Collection | Protocol Tunneling | Disk Wipe: Disk Structure Wipe | Establish Accounts: Social Media Accounts | |||||
| Trusted Relationship | Cloud Administration Command | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Valid Accounts: Cloud Accounts | Audio Capture | Financial Theft | Establish Accounts: Email Accounts | |||||||
| Phishing | Hide Artifacts: Hidden Window | Video Capture | Develop Capabilities: Malware | |||||||||||
| Selective Exclusion | Data from Information Repositories: Sharepoint | Obtain Capabilities: Malware | ||||||||||||
| Social Engineering: Impersonation | Archive Collected Data: Archive via Utility | Obtain Capabilities: Tool |
KQL Query (1)
-
Handala – Bulk File Access/Copy Without Corresponding Encryption Activity
Exfiltration
Sentinel
T1567.002
YARA Rules (1)
Victims (176)
We, the members of Handala Hack, proudly announce that through a targeted and intelligent operation,…
In continuation of our series of cyber operations against the military infrastructure of the Zionist…
On the occasion of Passover, this significant holiday for our dear Zionists and beloved occupiers, w…
We inform the honorable and resilient people that the complete details along with clear photos of 20…
Today, for the first time, the complete details of 50 senior officers from Unit 9900 of the Israeli …
They thought by spilling the innocent blood of Minab’s children, they could silence the voices of th…
Raz Zimmt, Head of the Iran Desk at the Israeli National Security Institute, Once again, you ignore…
Ms. Vered Haimovich, Tonight, there’s nowhere left to hide; The shadows see everything, and it’s tim…
It was a quiet night; but for hundreds of stores across America, it marked the start of a harsh awak…
Today, Handala Hack successfully took down the largest store in the Missoula, USA—Good Food Store, e…
Once again, the vigilant hand of resistance has struck at the rotten heart of the occupying regime. …
Today, once again, the world witnessed the collapse of America’s so-called security legends. While t…
Lockheed Martin Employees Given 48 Hours to Respond: A Tight Deadline Looms We, the Handala Hack , h…
Today, once again, the iron walls of Zionism have collapsed. We, Handala Hack, proudly announce that…
To the awakened nations and all free people of the world, The seizure of our domains, propaganda bom…
To the awakened nations and all the free people of the world, Today, one of the most crucial links i…
Know and be aware: If Iran’s power plants are targeted, the response will not only be at the same le…
In the silence of the night, the communication lines of the Zionist regime are no longer calm. You d…
$50M Reward For Trump & Netanyahu To all freedom seekers and justice warriors around the world: We, …
In history, there is always a moment when the hunter becomes the hunted. Today, that moment has arri…
The enemies thought that by silencing the smile of a great man, they could extinguish the sun of hop…
The list of 180,000 Iranian members of this channel, along with their mobile numbers, has been publi…
The crimes and foolishness of the leaders of the Epstein sect and the Kahanist sect have reached suc…
Today, a shadow has been lifted from one of the darkest layers of the Israeli intelligence and secur…
Today, for the first time, we proudly release the documentation of a unique cyber operation, an oper…
In an incident that sent shockwaves through the Israeli intelligence apparatus, the personal email o…
Today, the iron walls of secrecy and the illusion of security within the Zionist regime have been sh…
In unwavering obedience to the command to keep the Strait of Hormuz closed, we, the warriors of Hand…
Hey Tamir, Still feeling safe behind those fancy titles? Former chief of Aman, and now the proud exe…
On Quds Day, a new chapter was written in the realm of cyber warfare. Handala Hack successfully targ…
Mr. Raz Zimmt, Do you still think you can comment on Iran? Today, you learned the hard way what happ…
We announce to the world that, in retaliation for the brutal attack on the Minab school and in respo…
Full Access: Jerusalem’s Security Cameras in Handala’s Hands Jerusalem’s Security Cameras Hacked F…
In response to the ongoing brutal crimes of the occupying regime against the people of the resistanc…
In the name of freedom and justice To all freedom-seekers of the world; We, the members of Handala H…
Greetings to all freedom-loving nations and resistance fighters. Following a series of successful cy…
In response to the blatant aggression against the Qeshm desalination plant, Handala Hack has execute…
Please Join and Share https://t.me/HANDALA_HPR2 https://t.me/HANDALA_HPR2 https://t.me/HANDALA_HPR2…
Tonight, the silence of the Persian pages of the Zionist army has been broken. Handala Hack is here;…
In the name of freedom and under the shadow of the oppressed’s revenge, The Sanzer Hasidic community…
In our ongoing efforts to confront the support networks of the Zionist occupation regime, Handala Ha…
INSS Hacked Your national security is built on deception, media manipulation, and the brainwashing o…
Today, one of the UAE’s largest oil and gas giants, Sharjah National Oil Corporation, has fallen to …
One of the most prominent oil and gas exploration companies has been hacked. This is the beginning o…
Clalit Security Breach: Israel’s Largest Healthcare Organization Falls to Cyber Resistance In the na…
The General in the Shadows: Sapir’s Commander Exposed They say the cornerstone of the Zionist regime…
The youths of resistance’s eyes are wide open; they see and hear everything. When the time comes, th…
Several weeks ago, the breach of the i24 channel was not a mere coincidence or an act of random disr…
Avraham Hayyim ( Mehrdad Rahimi ) | (Guiding Officer of Iranian Agents in Mossad’s Iran Desk) Mehrd…
We are now releasing a comprehensive 150-page list of Ayelet Shaked’s contacts, an act of informatio…
For the first time, Handala RedWanted delivers a decisive blow to the Zionist regime’s intelligence …
Unveiling the Secrets: Inside the WhatsApp Chats of a Minister As we pledged, we are now publishing …
The Queen’s Secrets: Unveiling the Mysteries Behind Ayelet Shaked Once again, the cyber world has wi…
Official Statement from Handala People’s Resistance Front of Truth-Seekers (HPR) on the Launch of Ha…
Handala Hack | Bibi Gate: The Truth Denied, The Evidence Unfolds Once again, as expected, the Prime …
Bibi Gate Operation: The Gatekeeper’s Fall To Netanyahu’s inner circle, To every official still clut…
Handala Command acknowledges with gratitude the messages from Jews who oppose the killing of childre…
As part of our ongoing commitment and in accordance with our tradition every Saturday, today Handala…
The people are held captive by the Kahani sect. We distinguish between you and the leaders of the ch…
To Naftali Bennett, We watched your video with great amusement as you tried to brush off the truth, …
Naftali Bennett has publicly denied any breach and insists that his phone was never hacked. However,…
Dear Naftali Bennett, You once prided yourself on being a beacon of cybersecurity, parading your exp…
Hello Naftali, Today is not just another day in your calendar of illusions. Today, we celebrate the …
Once again, Handala RedWanted has shattered the illusion of security within the Zionist regime. This…
The veil has finally been lifted. The main architects behind Israel’s so-called “Iron Dome” have now…
WANTED – $10,000 REWARD Ron Weinberg Email: [REDACTED]@gmail.com Phone: +972 [REDACTED] 279 0256 Ron…
Dr. Isaac Gertz, By now, you have surely felt it, the subtle shift in the air around you. The moment…
Today, Saturday, Handala RedWanted tears the mask off the Zionist regime’s aerospace elite. We are l…
This Saturday, Handala RedWanted decided to do things differently. We set our sights directly on the…
As per our unbreakable tradition, every Saturday, the world awaits the chilling revelation from Hand…
Saturdays may be ordinary on your calendar, but for us, they mark a day of revelation, a day when we…
In the realm of silence and secrets, every shadow carries a story, and every story eventually finds …
On this significant anniversary of the martyrdom of Commander Reza Awada, we bow our heads in respec…
As part of our relentless campaign of truth and justice, every Saturday we unveil another layer of t…
As promised, every Saturday, we unveil a new chapter in exposing those complicit in the machinery of…
Handala Hackers – Operation Blackout: Delek System Breached This is not a warning. This is a demonst…
From the Depths of Cyberspace: Handala RedWanted Declaration For two relentless years, Handala’s cyb…
In the Name of God, the Most Gracious, the Most Merciful Statement of Establishment Of the Grassroo…
Despite Spacecom’s legendary talent for saying “No comment” faster than a rocket launch, you can now…
We, the Handala Hack, have successfully breached the security systems of Spacecom (Space Communicati…
On the anniversary of the martyrdom of Sayyed Hassan Nasrallah, Handala has a wonder! Tonight … Toni…
We will soon be in your hollow regime and corrupt clique. The depth of our influence goes beyond you…
In an age where propaganda masks itself as journalism, and occupation is whitewashed through prime-t…
Arghavan ShamsArghavan Shams is a journalist and the person responsible for promoting LGBTQ-related …
Mojtaba, Are you still under the illusion that the Stables Rectory Farm meeting in Halstead was priv…
You only saw the tip of the iceberg… When you first assumed that only your Telegram had been comprom…
Iran International has been successfully hacked. All of the network’s systems, servers, and communic…
Freedom Wood Doors Ltd Hacked Freedom Wood Doors Ltd, a manufacturer of interior doors based in Hod …
Niflaot Hatzuna Ltd Hacked They called it just catering. Food service. Logistics. A contractor with …
Ivri, Kerner & Co Hacked In the name of truth and memory, This is Handala, the barefoot witness of i…
GlobaLinks Hacked This is Handala. I do not forget. I do not forgive. And I do not look away. Today,…
ClockWorkAdmin Hacked To the management of Clockwork Admin, This is not a test. This is not a drill.…
Dear Weizmann, Boom. That’s the sound your data center made. We hear the servers didn’t make it. The…
JobPlace Ltd Hacked After the Job Info company, it’s now time for Job Place Today, we confirm that J…
Israel Job Info Ltd Hacked To the largest employment arm of the regime… You called yourselves the ga…
Shelter Locations in Israel The list of Israeli shelters has been exposed. Every location is now kno…
Ben Horin & Alexandrovitz Ltd Hacked In the silence of the night, digital shadows stirred. We entere…
Zacharia Levi Ltd Hacked Handala, hereby declare that we have successfully infiltrated the servers o…
We have successfully infiltrated the digital infrastructure of Kibbutz Almog. Our operation has resu…
Haor Heavy Transport Hacked Few outside the region have heard of Haor, an unassuming overland transp…
Saban Systems Hacked Saban Systems, has quietly become a central player in Israel’s expanding survei…
Agura B.C., LTD ,the unseen architect behind the software of countless crypto exchanges worldwide , …
For years, mor-logistics ltd operated silently,trusted by multiple security agencies to move sensiti…
In a complex, coordinated hybrid operation, the Handala Group has successfully breached and compromi…
The Handala Group has successfully infiltrated and compromised the internal systems of TBN Israel, a…
Delkol and Delek have been compromised Your fuel systems are exposed. and so are your secrets. Over …
Y.G. New Idan Ltd, the secret arm of Israel’s Ministry of War, has been compromised This is the enti…
Delkol and Delek have been compromised Your fuel systems are exposed. and so are your secrets. Over …
Aerodreams has been compromised They used to fly for the Air Force , now they hide behind Aerodreams…
To the self-proclaimed guardians of order in Israel, Your arrogance has been your downfall. Did you …
Ministry of National Security Hacked Happening now: 1- Hacking the comprehensive integrated manageme…
Handala Hack Breaches Allen Carr’s Easyway Company in Supply Chain Attack, Dump Customer Database an…
Shirbit was one of the largest insurance companies in the Zionist regime, which provided all cars an…
Handala Hacked SSV Blockchain Network ( Mossad financing and money laundering network ) Where did t…
Handala hacked the airgap network of Elad Municipality! The municipality is closed today, don’t visi…
IM Cannabis is one of the main arms of the distribution of hallucinogenic and dangerous drugs in Eur…
50K Secret Emails of Ron Prosor, senior officer of Mossad! Your Death is Near! We have been and are …
300 GB of IIB Data Leaked Handala Hacked IIB ( Israeli Industrial Batteries ) IIB is one of the comp…
110,000 secret emails of the former prime minister! This is Ehud Barak, your former prime minister! …
60/000 secret Emails This data is only a small part of our data lake about Gabi Ashkenazi , former M…
2/000 private photos of Benny Gantz The former defense minister of the Zionist regime has taken very…
35/000 Confidential Emails of Benny Gantz Publish for First Time In recent days, we found out that B…
Handala Hacked IIB ( Israeli Industrial Batteries ) IIB is one of the companies affiliated to the Mi…
Handala Hacked Appletec Ltd. It is an affiliated company of the Ministry of Defense of the regime an…
For the first time, as a PoC, we are publishing a number of top-secret documents for the design of e…
10GB EPS Tech confidential source code PoC Handala has about 800 GB of the source code of sensitive …
Handala Hacked EPS Tech Ltd EPS are designers and providers of advanced embedded electronic systems …
Handala Leaked 3TB Innovalve Sensitive Data On July 17th, Edwards Lifesciences American company boug…
Handala Leaked 3TB Innovalve Sensitive Data On July 17th, Edwards Lifesciences American company boug…
Handala’s attack on Israeli organizations Yesterday, after the problem occurred in CrowdStrike, Hand…
Do you know real Eyal Baror? Does Edwards Lifesciences know who he made a deal with? Have we gone to…
Dear Eyal Baror You have 24 hours to resign and take responsibility for this disaster, otherwise we …
Congratulations on setting fire to an incredible $300 million! Handala Hacked Innovalve Bio Medical …
Handala Hacked Sheba Medical Center Chaim Sheba Medical Center is the largest hospital in Occupied l…
Gas now! Handala Hacked Sonol At a time when our children are under severe siege and no medicine or …
Handala Hacked Centralized system of Independent Education System of Haredi Judaism! As you can see,…
Handala Hacked Zerto ( One of the largest Zionist cyber security companies in the world ) Zerto, a H…
Irresponsibility is one of the characteristic features of a Zionist! More than a week has passed sin…
Handala Hacked Ma’agan Michael Kibbutz Ma’agan Michael is among Israel’s largest and most financiall…
It seems that data breach is not important for SolidCAM (https://www.solidcam.com/) ! As we said bef…
Did you receive Handala’s message (https://www.israelhayom.co.il/tech/tech-news/article/15843626) on…
Hello to the Zionist information technology community! Handala Hacked: Cello (formerly Cellopark) ME…
Standard Textile, Arad Textile Industries, North Division Hacked By Handala! 1.9 TB Data Dumped! …
Handala Hacked Massad Quality Massad College provides a wide range of courses and continuing educati…
Handala Hacked Smart College (The largest Zionist cyber security college ) Smart College is a leadin…
Handala Hacked 99 digital and send last messages to Zionists! This was a clear message to 8200 not t…
For the second time we Hacked your radar systems… but this time with a difference! You only have a f…
Handala Hacked Kashin Distillery ( One of the largest factories for the production of alcoholic beve…
Handala Hacked High Group High Group is one of the main sources of settlement development in the occ…
We told that any company or person will take action to build a settlement in our lands, it will be t…
Handala Hacked Harmony Pharm ( One of the largest pharmacies in Tel Aviv ) harmonyisrael.co.il The g…
Handala Hacked Ramat Gan Academic College The Israel Academic College in Ramat Gan is a leading acad…