Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Handala – Bulk File Access/Copy Without Corresponding Encryption Activity

Handala Exfiltration Sentinel
MITRE ATT&CK
Exfiltration to Cloud Storage
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (handala); generic pure-leak-actor detection logic
What This Detects
Handala (per this group's own profile, not a traditional encryption-based ransomware operation) is a hacktivist-aligned leak actor – hunting should focus on the exfiltration stage: unusually high-volume file copy/rename activity with no corresponding mass-encryption pattern.
Query
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileCopied","FileRenamed")
| summarize FilesTouched = count(), DistinctFolders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where FilesTouched > 5000 and DistinctFolders > 20

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.