Handala is a apt_group tracked across 23 threat clusters and 46 intelligence report mentions on ThreatCluster. First observed December 28, 2025; most recent activity June 13, 2026.
On March 11, 2026, medical technology firm Stryker experienced a significant cyberattack attributed to the Iran-linked hacking group Handala. The attack exploited vulnerabilities in Stryker's Microsoft Intune endpoint…
On April 9, 2026, the Iranian-linked hacking group Handala announced it had breached the personal devices of former Israeli Chief of Staff Herzi Halevi, leaking over 19,000 sensitive files. The leaked materials include…
On March 11, 2026, the Iranian-linked hacking group Handala executed a significant cyberattack on Stryker, a major U.S. medical technology company, causing a global disruption across its Microsoft environment. The…
Stryker, a U.S.-based medical technology company, suffered a significant cyberattack attributed to the Iranian-linked hacking group Handala. The attack, which began shortly after midnight on March 12, 2026, involved a…
The Iran-aligned hacking group Handala has claimed responsibility for breaching California water utility systems, framing the operation as retaliation for recent US airstrikes that damaged water infrastructure in Iran.…
CVE-2026-21514 is a security feature bypass vulnerability in Microsoft Word, disclosed on February 10, 2026. This flaw allows attackers to exploit nearly 14 million assets across seven Tier 1 countries, primarily in the…
US officials suspect Iranian hackers have breached automatic tank gauge (ATG) systems at gas stations across multiple states. The attackers exploited unprotected internet-connected systems, allowing them to manipulate…
On March 27, 2026, the Iranian-linked hacking group Handala claimed to have breached FBI Director Kash Patel's personal email account, releasing over 300 emails and personal photographs online. The FBI confirmed the…
The Iran-linked hacking group Handala claims to have breached FBI-operated drones used for security at the 2026 FIFA World Cup, which began on June 11, 2026. They assert access to sensitive data, including images and…
On April 2, 2026, the Iranian hacker group Handal claimed to have breached PSK Wind Technologies, an Israeli defense contractor specializing in command and control systems. The breach reportedly involved the release of…