Amid headlines dominated by missiles and airstrikes in the Middle East, a strike by Iran-linked hackers on a US company appears to have rattled the Trump administration. After the hacking claim went viral, the US government took big steps to push back against the Iranian cyber network.
In a statement on Thursday, the US Department of Justice (DOJ) linked the attempt as a “Cyber Enabled Psychological Operations” by the Islamic Republic of Iran’s Ministry of Intelligence and Security.
The DOJ announced the seizure of four domains, Justicehomeland[.]org, Handala Hack to, Karmabelow80[.]org and Handala Redwanted[.]to, allegedly associated with the hacking group Handala. According to US authorities, the domains were used to publicise hack claims, dump stolen sensitive data and threaten those seen as enemies of the Iranian regime, including dissidents, journalists and Israelis.
The move marks a significant escalation in the US response to Handala. On March 11, one of the seized domains, Handala Hack to, was used to claim responsibility for the malware attack on Stryker, a US medical technologies company, an incident earlier reported by India Today.
Just days before that, another Handala-linked domain, Handala-Redwanted to, published the names and sensitive personally identifiable information of around 190 individuals linked to the Israeli Defense Forces and the Israeli government.
The affidavit supporting the seizure warrant says Handala also leaked a list containing the names of two executives from a US defence technology firm and called on followers to target them.
US authorities say Handala was part of a wider network of shell personas, including aliases such as “Karma Below” and “Justice Homeland”, run by the same individuals linked to Iran’s Ministry of Intelligence and Security.
Handala’s X account, @hprnew, was suspended, cutting off one of the group’s key public channels used to circulate leaks and amplify its claims. But the takedown has not erased Handala’s online footprint. A new website has already appeared, while its Telegram channel remains active even after older posts tied to previous hacking claims against Israel and the US were removed, suggesting an effort to rebuild while scrubbing parts of its public trail.
FBI Director Kash Patel cast the action as a warning to Iranian cyber operators “Iran thought they could hide behind fake websites and keyboard threats to terrorise Americans and silence dissidents. We took down four of their operation’s pillars and we’re not done” he said.
Handala responded on its new website, saying: “The US Department of Justice and its security agencies, through issuing threatening statements and carrying out acts of censorship and intimidation, believe they can extinguish the flame of truth. But they are oblivious to the fact that Handala is not merely a website or a name; Handala is a deep-rooted idea and a global outcry echoing in the hearts of all the free.”
