The U.S. Justice Department has accused the Iranian government of orchestrating the hacktivist group Handala, responsible for a recent cyberattack on the American medical technology firm Stryker. This assertion was made public in a press release issued on Thursday, revealing that Iran's Ministry of Intelligence and Security (MOIS) is allegedly behind the operations of Handala.
According to the Justice Department, Handala operates as a fictitious activist group utilized by the Iranian ministry to conduct psychological operations against perceived adversaries. These operations include claiming responsibility for cyberattacks and disseminating stolen information. The group has also been reported to incite violence against journalists and dissidents, as highlighted by the DOJ.
This announcement coincided with the FBI's seizure of two websites linked to Handala, which were employed to promote its cyber activities and release personal information of individuals associated with the Israeli military and defense sector. Handala publicly claimed responsibility for the March 11 attack on Stryker, during which hackers allegedly wiped data from tens of thousands of employee devices, asserting the attack was retribution for U.S. actions in Iran.
FBI Director Kash Patel stated that the agency has dismantled key elements of Handala's operations, emphasizing that their efforts are ongoing. In addition to the Handala websites, the DOJ also confiscated domains associated with another hacktivist group known as "Justice Homeland," which has been linked to prior cyberattacks against the Albanian government.
In a court affidavit supporting the seizures, the FBI indicated that Handala, Justice Homeland, and another group named Karma Below are interconnected, suggesting a coordinated effort among these entities. Despite the DOJ's actions, Handala responded defiantly on its Telegram channel, characterizing the U.S. government's measures as attempts to stifle its voice.
Cybersecurity expert Keith O'Neill noted that Handala has already initiated the creation of new domains to continue its activities, indicating a resilient operational capacity. The group did not respond to inquiries regarding its activities, nor did Iranian officials or Stryker comment on the allegations.
Experts suggest that the individuals behind Handala may not be directly involved in the hacking itself, indicating a complex structure where various teams could be executing distinct roles within the overarching MOIS framework. This level of operational opacity presents challenges in fully understanding the dynamics of such cyber activities.
The implications of these developments could reshape the landscape of cybersecurity and international relations, emphasizing the need for robust defenses against sophisticated cyber threats.
