{ "Event": { "analysis": "1", "date": "2026-06-02", "extends_uuid": "", "info": "[Threat Intel] Iran Expands Handala Brand to Physical Threats", "protected": false, "publish_timestamp": "1780521482", "published": true, "threat_level_id": "2", "timestamp": "1780521482", "uuid": "5cdd986c-7f2c-4576-bbce-0b56918f50c4", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#bf83fd", "local": false, "name": "misp-galaxy:producer=\"Recorded Future\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#3d38fc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#e8825f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#65d24c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"", "relationship_type": "" }, { "colour": "#b206a3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Accounts - T1586\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#4b76ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Org Information - T1591\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#2da3e8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"", "relationship_type": "" }, { "colour": "#00f752", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#6b4ab5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Manipulation - T1565\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#a0d02a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"", "relationship_type": "" }, { "colour": "#6440db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Establish Accounts - T1585\"", "relationship_type": "" }, { "colour": "#a05856", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#d9210a", "local": false, "name": "misp-galaxy:target-information=\"Albania\"", "relationship_type": "" }, { "colour": "#26fab6", "local": false, "name": "misp-galaxy:target-information=\"Israel\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780484410", "to_ids": false, "type": "link", "uuid": "211c11d8-456f-4e55-8c26-ec2c5269351a", "value": "https://www.recordedfuture.com/research/iran-handala-physical-threats" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780484410", "to_ids": false, "type": "link", "uuid": "c65c1c02-1c00-42e2-9c95-9814150c692c", "value": "https://www.recordedfuture.com/research/media_14c4348cdfe3e4e2b574896b502432695b25c37a9.gif?width=1200&format=pjpg&optimize=medium" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780484410", "to_ids": false, "type": "text", "uuid": "f310e737-5e04-445a-9062-dbdff1000ced", "value": "Iran's Ministry of Intelligence has broadened its Handala brand beyond cyber operations to include physical threats and influence campaigns targeting US and Israeli interests. The expansion encompasses multiple personas: Handala Popular Resistance Front claiming physical attacks inside Israel, VIPEmployment recruiting proxies globally for espionage and sabotage, and MOISIRAN conducting surveillance operations. These entities engage in coordinated amplification across platforms, soliciting individuals to conduct attacks for financial rewards. The consolidation creates a multi-domain threat combining hacktivist activities with physical operations, espionage recruitment, and influence campaigns. This approach leverages Handala Hack Team's recognition to amplify recruitment efforts while increasing risks to law enforcement, military, intelligence personnel, and critical infrastructure across targeted regions." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780484410", "to_ids": false, "type": "text", "uuid": "ba0096f4-2bf7-48d9-9901-6c42226b64e5", "value": "Name: Iran Expands Handala Brand to Physical Threats\nAuthor: AlienVault\nAdversary: Void Manticore\nTags: [\"hprf\", \"void manticore\", \"proxy recruitment\", \"handala hack team\", \"coordinated inauthentic behavior\", \"cryptocurrency payments\", \"telegram recruitment\", \"physical operations\", \"israeli targeting\", \"bibi wiper\", \"wiper attacks\"]\nTgtd countries: [\"United States of America\", \"Albania\", \"Israel\"]\nMlwr families: [\"BiBi wiper\"]\nAttack_ids: [\"T1583\", \"T1071\", \"T1195\", \"T1190\", \"T1589\", \"T1586\", \"T1204\", \"T1591\", \"T1059.001\", \"T1590\", \"T1048\", \"T1566\", \"T1565\", \"T1078\", \"T1027\", \"T1486\", \"T1598\", \"T1585\", \"T1485\", \"T1574.002\"]\nIndustries: [\"Government\", \"Defense\", \"Energy\", \"Transportation\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1780495853", "to_ids": false, "type": "threat-actor", "uuid": "9556241a-f2f1-4bbe-91c7-0ebad07034ec", "value": "Handala", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Void Manticore\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"BANISHED KITTEN\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501433", "to_ids": true, "type": "domain", "uuid": "14260c5d-35f2-45b8-b93e-8325f603ed27", "value": "justicehomeland.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501455", "to_ids": true, "type": "domain", "uuid": "3a08f3ba-0a0f-4427-beee-04ad3e0533fc", "value": "handala.red", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501476", "to_ids": true, "type": "domain", "uuid": "1683a637-6b4d-4906-b72c-2b80cebf9acc", "value": "handala-hack.tw", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501497", "to_ids": true, "type": "domain", "uuid": "fe156a07-1425-477d-8e51-29042006c42b", "value": "justicehomeland.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501518", "to_ids": true, "type": "domain", "uuid": "f7ab90a1-221d-45f7-a52b-4cd9a6f7e297", "value": "justicehomeland.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501542", "to_ids": true, "type": "domain", "uuid": "8dac9bc5-8a33-4f23-8f21-11a90ea7142e", "value": "handala-hack.ps", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501563", "to_ids": true, "type": "domain", "uuid": "46cfcfe7-951b-4d23-9a7c-69bf8f6fa197", "value": "handala-redwanted.ps", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501584", "to_ids": true, "type": "domain", "uuid": "60429f2b-139c-4858-b84b-0bdccd0aa685", "value": "handala-alert.ps", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501605", "to_ids": true, "type": "url", "uuid": "0f73d40e-761c-4be3-8a10-9b90e0c3424b", "value": "t.me/CYBER_HANDALA", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501626", "to_ids": true, "type": "url", "uuid": "967d3935-986e-4cf1-9775-4e5eb2bbb239", "value": "t.me/HANDALA_INTEL", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501647", "to_ids": true, "type": "url", "uuid": "08d66c0c-958b-4401-a911-ce2e8a7f26b2", "value": "t.me/HANDALA_BREACH", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501668", "to_ids": true, "type": "url", "uuid": "703eedd9-2d6f-41c9-97ba-d55611214d1d", "value": "t.me/justice_homeland", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501689", "to_ids": true, "type": "url", "uuid": "0662f19c-eb1d-4cba-b496-babc934e3821", "value": "t.me/JusticeHomeland1", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501710", "to_ids": true, "type": "url", "uuid": "21f03ecb-15b3-4990-86cb-1c48fd9af9c0", "value": "t.me/shitesirruges", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501731", "to_ids": true, "type": "url", "uuid": "76c57f6b-43a2-4cb7-9a8f-77aeba519805", "value": "t.me/HANDALA_PARTISAN", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501752", "to_ids": true, "type": "url", "uuid": "aafe6d5d-1d2e-4c9e-b5d2-0b40cf5c09ba", "value": "t.me/VIPEmployment_bot", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501773", "to_ids": true, "type": "url", "uuid": "b906fd55-89b3-4947-b38e-d1e301916081", "value": "t.me/Ir_intel_voice", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501794", "to_ids": true, "type": "url", "uuid": "5e121ab7-b877-4f23-8124-aea6acb68709", "value": "t.me/Ir_intel_voice_ar", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501815", "to_ids": true, "type": "url", "uuid": "46e15c91-0731-4aef-92e5-bbc9c7815087", "value": "t.me/ir_intel_voice_ar_dis", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501836", "to_ids": true, "type": "url", "uuid": "9932801d-632e-4322-8750-181f252f4f5f", "value": "t.me/@iranvipemployment_bot", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501857", "to_ids": true, "type": "url", "uuid": "98fbbcab-f99e-4de8-a85e-3d5faab3fe3f", "value": "t.me/@VIPEmploymentBot", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501879", "to_ids": true, "type": "url", "uuid": "0ede5ee9-7b28-4e29-8d2b-cfee49bcf4b7", "value": "t.me/@VIPEmployment01Bot", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501900", "to_ids": true, "type": "url", "uuid": "8c1cf561-ba9c-40c2-ba30-23aa069e9eff", "value": "t.me/@VIPEmployment02Bot", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501921", "to_ids": true, "type": "url", "uuid": "0f2778d0-9f90-44e8-bdd2-b62f63367408", "value": "tiktok.com/@vipemployment", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501942", "to_ids": true, "type": "url", "uuid": "c55062e8-7707-448a-a3bc-a8fdd4917f81", "value": "t.me/moisiran", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501963", "to_ids": true, "type": "url", "uuid": "0f76a505-60fe-41df-9802-02accf9ad7ce", "value": "t.me/@vipconnect_iran", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780501984", "to_ids": true, "type": "url", "uuid": "047ff3d4-2c5c-499c-bb34-c198cf72638e", "value": "t.me/brave_il", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780502005", "to_ids": true, "type": "url", "uuid": "29b382ed-c046-4d47-a1f6-452c2f647f99", "value": "t.me/@Braveil", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780502026", "to_ids": true, "type": "url", "uuid": "7cc5ff02-6662-428e-947e-3eaaf6e23f35", "value": "t.me/@Brave_2025", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] } ] } }