Back Gbhackers

Handala Hackers Exploit RDP and NetBird in Coordinated Wiper Attacks

Gbhackers •Mayura Kathir • March 16, 2026

Handala Hack is an Iranian state-linked destructive actor that combines old-school RDP-heavy intrusions with new tools like NetBird and AI-assisted wipers to devastate victim networks rapidly. Handala Hack is an online persona operated by Void Manticore (also tracked as Red Sandstorm and Banished Kitten), a threat actor affiliated with Iran’s Ministry of Intelligence and Security (MOIS). Additional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Handala Hackers Launch Destructive Cyberattacks Using RDP and NetBird Handala Hack, an Iranian state-linked threat actor, has executed a series of destructive cyberattacks targeting organizations in Israel, Albania, and the United States. The attacks utilize Remote Desktop Protocol (RDP) and the NetBird network tunneling tool, alongside multiple parallel wiper tools designed to erase data. This group operates under the identity of Void Manticore, also known as Red Sandstorm and Banished Kitten, which is affiliated with Iran’s Ministry of Intelligence and Security (MOIS). The scope of the impact remains under assessment, but the attacks have been characterized by their rapid execution and significant destructive capability. Specific details on the number of affected systems and exact CVEs are not disclosed in the articles. The current status indicates ongoing investigations into the attacks and potential mitigation strategies. Security professionals are advised to monitor for signs of RDP exploitation and to review their defenses against wiper malware. 2 sources 75

Extracted Entities

Handala Hackers Exploit RDP and NetBird in Coordinated Wiper Attacks

The full story

Extracted Entities

APT Groups (4)

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)