Handala (hacker group)
Hacking persona that has leaked material from Israeli officials and institutions since late 2023, reported by security researchers to be operated by an Iranian state-linked group
| Handala (hacker group)
| |
|---|---|
| Logo |  Handala logo, as reproduced by Check Point Research (2026) |
| Type | Hacking and leaking persona |
| Founded | 2023 |
| Services | Hack-and-leak releases, data wiping and intimidation of Israeli targets, according to security researchers |
| Remarks | Check Point Research and MITRE ATT&CK attribute the persona to Void Manticore, which they link to Iran's Ministry of Intelligence and Security (MOIS)[1][2] |
Handala (also Handala Hack) is a hacking persona that has released emails, files and phone data taken from Israeli officials, companies and state bodies since late 2023. Several of its releases have been republished by Distributed Denial of Secrets (DDoSecrets), which describes Handala as "a hacking group that is believed to have ties to Iranian intelligence".[3]
Check Point Research reported in March 2026 that "Handala Hack" is "an online persona operated by Void Manticore (Red Sandstorm, Banished Kitten), a MOIS-affiliated threat actor", and that it "appears to draw its name and imagery from the Palestinian cartoon character Handala".[1] MITRE's ATT&CK knowledge base lists Handala Hack as an alias of the group it calls VOID MANTICORE, which it says is "assessed to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS)".[2]
Powerbase pages that use material from Handala releases attribute it to the leak and note that it has not been independently verified.
Attribution by security researchers
Check Point Research first described Void Manticore in May 2024 as "an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS)" that carries out "destructive wiping attacks combined with influence operations" under several online personas, including Karma (for attacks in Israel) and Homeland Justice (for attacks in Albania).[4] Its March 2026 report says the Handala persona "has been used extensively since late 2023 and represents one of the group's three primary operational fronts", alongside Karma and Homeland Justice. It says Handala Hack "has been responsible for multiple intrusions in Israel" and has recently expanded its targeting to US companies, such as the medical technology firm Stryker.[1]
The report also says that, "according to public reporting", Void Manticore overlaps with activity linked to the MOIS Internal Security Deputy, particularly its Counter-Terrorism Division.[1] MITRE says the group has been active "since at least mid-2022" and has targeted government bodies, critical infrastructure and private companies in Albania, Israel and the United States.[2]
Releases published by DDoSecrets
Distributed Denial of Secrets files these datasets in its "Cyberwar" category. It warns that such datasets carry "an increased chance of malware, ulterior motives and altered or implanted data, or false flags/fake personas".[5]
| Dataset | DDoSecrets publication date | Notes |
|---|---|---|
| Israel Police | 25 February 2025 | About 100,000 files. DDoSecrets says Handala "has been previously tied to Iranian state actors, and is known for their wiper campaigns". Israel Police said the breach had occurred at "third-party entities that receive information from the police".[6] |
| SSV Network | 3 June 2025 | Files from an Israeli blockchain company. DDoSecrets says Handala "is believed to be associated with or a front for Iranian intelligence, and has been tied to wiper attacks and hack and leak operations".[7] |
| Benny Gantz emails | 27 August 2025 | Emails of Benny Gantz, including 2015–16 planning of an anti-BDS company with the Institute for National Security Studies.[3] Jack Poulson reported on the cache in September 2025.[8] |
| Ron Prosor emails | 3 October 2025 | Emails of Ron Prosor, covering May 2005 to May 2016. DDoSecrets repeats that Handala is "believed to have ties to Iranian intelligence".[9] |
| Ayelet Shaked | 13 March 2026 | Chats of the former justice minister Ayelet Shaked.[10] |
| Tamir Hayman emails | 13 March 2026 | Emails of Tamir Hayman, former head of military intelligence and director of the Institute for National Security Studies.[11] |
| Tzipi Livni mobile | 15 October 2026 | "Text messages and contact information" from the phone of Tzipi Livni.[12] |
Use of the releases
Jack Poulson used the Gantz emails to report on the "12 Tribes" anti-BDS initiative of 2015–16. He described the documents as "putative" and "purported", and said the people named in them did not respond to requests for comment.[8] Powerbase pages such as Benny Gantz, Kela Shlomo and Gilad Erdan draw on the same cache. They attribute it "according to leaked emails published by Distributed Denial of Secrets" and note that the emails have not been independently verified.
See also
Notes
- ↑ 1.0 1.1 1.2 1.3 Check Point Research, "Handala Hack" – Unveiling Group's Modus Operandi Check Point Research, 12 March 2026, accessed 21 October 2026. Security research.
- ↑ 2.0 2.1 2.2 MITRE, VOID MANTICORE, COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm, Group G1055 MITRE ATT&CK, created 20 April 2026, last modified 31 July 2026, accessed 21 October 2026. Security research.
- ↑ 3.0 3.1 Distributed Denial of Secrets, Benny Gantz emails ddosecrets.org, 27 August 2025, accessed 21 October 2026. DDoSecrets says the emails "were released by Handala, a hacking group that is believed to have ties to Iranian intelligence", and applies its "Cyberwar" disclaimer.
- ↑ Check Point Research, Bad Karma, No Justice: Void Manticore Destructive Activities in Israel Check Point Research, 20 May 2024, accessed 21 October 2026. Security research.
- ↑ Distributed Denial of Secrets, Consulate General of Israel in Atlanta, United States ddosecrets.org, 8 October 2024, accessed 21 October 2026. Text of the standard "Cyberwar" disclaimer.
- ↑ Distributed Denial of Secrets, Israel Police ddosecrets.org, 25 February 2025, accessed 21 October 2026.
- ↑ Distributed Denial of Secrets, SSV Network ddosecrets.org, 3 June 2025, accessed 21 October 2026.
- ↑ 8.0 8.1 Jack Poulson, Leak indicates billionaire funders of Israeli cyber campaign targeting anti-apartheid activists All-Source Intelligence (Substack), 17 September 2025, updated 27 September 2025. Critical.
- ↑ Distributed Denial of Secrets, Ron Prosor emails ddosecrets.org, 3 October 2025, accessed 21 October 2026.
- ↑ Distributed Denial of Secrets, Ayelet Shaked ddosecrets.org, 13 March 2026, accessed 21 October 2026.
- ↑ Distributed Denial of Secrets, Tamir Hayman emails ddosecrets.org, 13 March 2026, accessed 21 October 2026.
- ↑ Distributed Denial of Secrets, Tzipi Livni mobile ddosecrets.org, 15 October 2026, accessed 21 October 2026.