Home › Threat Actors › Handala
← All Threat Actors
Nation-State high Iran

Handala

Iranian state-sponsored (MOIS — Ministry of Intelligence and Security) · Politically motivated disruption / hack-and-leak / psychological operations against Israel and Western interests

Reports 1
Active Since 2023
Last Reported 17 Jun 2026
Sectors Targeted critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Hack-and-leak operations against Israeli government, military, and private sector organisations
  • Wiper malware deployment for destructive impact against Israeli targets
  • Third-party SaaS platform exploitation for lateral access to adjacent operational or billing systems
  • Exaggerated OT compromise claims for influence operations (capability systematically overstated in public statements)
  • Data publication via Telegram and dedicated leak sites
  • US and Western critical infrastructure targeting as retaliation for US-Iran military engagement
  • Internet-facing industrial and positioning platform exploitation as entry to utility-adjacent systems

Known Targets

Israeli government and defence organisationsIsraeli civilian infrastructureUS water utilities (Cal Water — June 2026)Western organisations perceived as supporting Israel or US military operations

Analyst Notes

See also: Handala (MOIS / Banished Kitten). Handala has been active since December 2023, escalating operations following the October 2023 conflict in Gaza and again following US military action against Iranian targets from February 2026. Named after a Palestinian cartoon character; explicitly frames operations as political retaliation. The June 2026 Cal Water breach demonstrated the third-party SaaS-to-billing-system access pattern but Mandiant confirmed no OT access. Distinguishing actual operational impact from influence exaggeration is essential in Handala incident assessment.

Also Known As

Banished Kitten (CrowdStrike)Handala Hack TeamHandala (MOIS / Banished Kitten)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1561 Disk Wipe T1041 Exfiltration Over C2 Channel T1498 Network Denial of Service T1059 Command and Scripting Interpreter

Intelligence Reports

Briefing critical-infrastructure

Handala Claims Breach of California Water Service, Exposing Customer Data and GNSS Credentials

Iran-linked Handala group claims 5GB exfiltration from California Water Service including customer records and RTKBase GNSS platform credentials across seven districts. Investigation ongoing; no OT disruption confirmed but destructive escalation risk is real.

17 Jun 2026 · 4 min read