Handala: Iran’s Hacktivist Front Becomes Tehran’s Cyber Retaliation Arm

Iran’s Handala, a MOIS-linked hacktivist front tied to the Void Manticore operation, has emerged as the public face of Tehran’s retaliatory cyberactivity amid US-Israeli strikes, using hack‑and‑leak campaigns and wiper malware to disrupt targets in Israel and the West. The Stryker breach is their most consequential operation to date, though researchers say Handala appears opportunistic rather than strategically planned, pursuing quick access and chaotic disruption while also scouting for surveillance opportunities across the Middle East, including hacked cameras.