Skip to content
ThreatCluster

Iran's MOIS Behind Coordinated Cyber Campaign Using Multiple Hacker Personas

First seen 20 Apr 2026, 17:26 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •April 21, 2026 at 17:02 UTC
  • •Iran's MOIS is using multiple hacker personas for a coordinated cyber campaign.
  • •The hacker identities include Homeland Justice, Karma/KarmaBelow80, and Handala.
  • •These personas were misidentified as independent groups, highlighting state-sponsored deception.

Iran's Ministry of Intelligence and Security (MOIS) is linked to a global cyber campaign utilizing three distinct hacker personas: Homeland Justice, Karma/KarmaBelow80, and Handala. These identities, previously thought to be independent hacktivist groups, are now confirmed to be part of a coordinated state-directed operation. The campaign's scope is global, affecting various sectors, although specific targets and attack vectors were not detailed in the articles. Researchers emphasize that these personas are interchangeable, allowing MOIS to obscure its involvement. The investigation into these identities has raised alarms about the sophistication and organization of state-sponsored cyber activities. Current status indicates ongoing scrutiny and analysis of the campaign's impact and methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 174d ago How this analysis works

Timeline

2026-04-20
Articles published linking MOIS to coordinated cyber campaign.

More articles in this cluster (2)