Back Cybersecuritynews

Handala Hack Uses RDP, NetBird, and Parallel Wipers in MOIS

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

An Iranian threat actor known as Handala Hack has carried out a series of destructive cyberattacks against organizations in Israel, Albania, and the United States, using remote desktop access, network tunneling, and multiple simultaneous data-wiping tools. The group operates under the broader identity of Void Manticore, also tracked as Red Sandstorm and Banished Kitten, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Handala Hackers Launch Destructive Cyberattacks Using RDP and NetBird Handala Hack, an Iranian state-linked threat actor, has executed a series of destructive cyberattacks targeting organizations in Israel, Albania, and the United States. The attacks utilize Remote Desktop Protocol (RDP) and the NetBird network tunneling tool, alongside multiple parallel wiper tools designed to erase data. This group operates under the identity of Void Manticore, also known as Red Sandstorm and Banished Kitten, which is affiliated with Iran’s Ministry of Intelligence and Security (MOIS). The scope of the impact remains under assessment, but the attacks have been characterized by their rapid execution and significant destructive capability. Specific details on the number of affected systems and exact CVEs are not disclosed in the articles. The current status indicates ongoing investigations into the attacks and potential mitigation strategies. Security professionals are advised to monitor for signs of RDP exploitation and to review their defenses against wiper malware. 2 sources 75

Extracted Entities

Handala Hack Uses RDP, NetBird, and Parallel Wipers in MOIS

The full story

Extracted Entities

APT Groups (4)

Attack Types (1)

Campaigns (1)

Countries (3)

Malware (1)

MITRE ATT&CK (3)

Tools (1)