Handala Syndicate Dossier

Emerging in late 2023 as an Iranian state-sponsored cyber operation tied to the Ministry of Intelligence and Security (MOIS), Handala operates under a pro-Palestinian hacktivist front (tracked by researchers as Void Manticore). The group specializes in politically motivated hack-and-leak, pseudo-ransomware, and destructive cyber sabotage targeting critical infrastructure, medical technology, and defense sectors in Israel and Western countries. Initial compromise is executed via spearphishing and credential theft, followed by living-off-the-cloud techniques—such as weaponizing Microsoft Intune to trigger mass remote device wipes—alongside custom .NET and AutoIT wiper payloads.