The Pro-Iran Hacktivist Group Behind the Stryker Cyberattack Origins and Symbolism. Handala, also known as the Handala Hack Team or Handala Hack, is a pro-Palestinian hacktivist collective that first emerged in late 2023, shortly after the escalation of the Israel-Hamas conflict in October 2023.
The group draws its name and branding from the iconic Palestinian cartoon character Handala, created by cartoonist Naji al-Ali in 1969. This character is portrayed as a 10-year-old boy with spiky hair, always shown from behind with his hands clasped, symbolizing the Palestinian people’s steadfast refusal to turn away from their cause or accept imposed solutions. The name “Handala” refers to a hardy, bitter plant that survives harsh conditions and regrows when damaged, embodying resilience and defiance in the face of oppression.
Affiliation and Attribution
Cybersecurity researchers from firms including Check Point, Palo Alto Networks Unit 42, IBM X-Force, Sophos, and others widely attribute Handala to Iran’s Ministry of Intelligence and Security (MOIS). It is often described as a “faketivist” persona or front operated by the Iranian state-linked actor cluster tracked as Void Manticore (also known as Storm-0842, Banished Kitten, Dune, or Red Sandstorm). This connection provides Iran with plausible deniability while enabling aligned cyber operations.
Indicators include Farsi-language artifacts in tools, operational ties during Iran’s internet restrictions (e.g., use of Starlink), and alignment with MOIS objectives. Handala blends genuine ideological hacktivism with state-backed sophistication, focusing on propaganda, disruption, and influence rather than purely financial motives.
Communication Channels
The group primarily operates through:
- A main Telegram channel (launched around December 18, 2023, with significant subscriber growth).
- Backup Telegram channels for redundancy.
- An X (formerly Twitter) account for claims and messaging.
- A leak site (previously handala[.]cx, later variants like handala[.]to) for publishing stolen data.
- Occasional posts on other platforms to amplify reach.
Statements are typically lengthy manifestos mixing political rhetoric, threats, and technical boasts, often timed to current events for maximum psychological impact.
Tactics and Techniques
Handala uses a combination of accessible yet effective methods, escalating to destructive actions during high-tension periods:
- Phishing and initial access — Spear-phishing emails, often impersonating security alerts (e.g., fake CrowdStrike or patch notifications).
- Data theft and leaks — Exfiltrating sensitive information for public release to cause reputational harm.
- Destructive wipers — Custom malware like Hatef (Windows) and Hamsa (Linux), delivered via multi-stage loaders (Delphi-based, AutoIT injectors) to wipe systems.
- Defacement — Overwriting login screens or websites with their logo and messages.
- Doxxing and intimidation — Leaking personal details of targets (officials, journalists, influencers) and issuing threats, sometimes with bounties or calls for physical action.
- Opportunistic exploits — Targeting misconfigurations, weak credentials, or third-party IT providers for broader access.
Their operations emphasize speed, visibility, and geopolitical messaging over stealthy persistence.
Primary Targets
Handala focuses on entities perceived as supporting Israel or opposing Iran:
- Israeli government, military, defense contractors, and political figures.
- Israeli critical infrastructure (energy, healthcare networks like Clalit, think tanks).
- Western companies with Israeli ties (e.g., Stryker, which acquired an Israeli firm in 2019).
- Journalists, dissidents, and influencers critical of Iran or supportive of Israel.
- Broader “Axis of Resistance” adversaries in the U.S., Gulf states, and elsewhere.
Notable Activities
- 2023–2025 — Heavy focus on Israel: data leaks from healthcare, high-tech, and political sectors; wiper deployments; threats against individuals.
- 2025–2026 escalation — Amid U.S.-Israel strikes on Iran (starting February 28, 2026, under Operations Epic Fury/Roaring Lion), Handala surged in prominence. It claimed operations against Israeli energy, Jordanian fuel systems, and threats to influencers.
- March 11, 2026 Stryker attack — Handala claimed a “complete success” in wiping over 200,000 systems/servers/mobile devices, shutting down offices in 79 countries, and exfiltrating ~50 terabytes of data. Framed as retaliation for the alleged U.S. bombing of a girls’ school in Minab, Iran (claimed 150+ deaths), and assaults on Axis of Resistance infrastructure.
The attack featured wiper behavior, defaced logins with Handala branding, and global disruptions to Stryker’s Microsoft-based environment.
- Other recent claims: Breaches of Israeli institutions, death threats via email with leaked addresses, and coordinated hack-and-leak efforts.
Impact and Assessment
While some operations rely on medium-sophistication tactics (opportunistic access, basic malware), Handala excels at influence and psychological warfare. Claims are amplified through social media and timed to conflicts, creating fear, division, and pressure on targets.
The Stryker incident marks a notable escalation, representing one of the first major claimed disruptions to U.S. critical infrastructure (healthcare supply chain) in the current U.S.-Iran conflict phase. Experts view it as part of Iran’s asymmetric cyber strategy, using hacktivist proxies for deniable retaliation against superior military powers.