FBI seizes pro-Iranian hacking group’s websites after destructive Stryker hack

In a significant move, the FBI has dismantled two websites associated with the pro-Iranian hacktivist collective Handala. This action comes in the wake of a severe cyberattack against the U.S. medical technology firm Stryker, which occurred last week. As of Thursday, the sites previously used by Handala to promote their hacking activities and disclose personal information about individuals linked to the Israeli military have been replaced with a banner declaring the law enforcement intervention. The seizure announcement from the FBI did not specify the reasons behind the action, but it suggested that U.S. authorities believe these websites were operated by hackers affiliated with a foreign government. The announcement stated, "Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor." This indicates a proactive effort to disrupt ongoing cybercriminal operations. TechCrunch confirmed the seizure by analyzing the website's nameserver records, which now direct to servers managed by the FBI. The FBI and the Justice Department have yet to respond to requests for further details regarding the takedown. On their official Telegram channel, Handala expressed awareness of the website seizure, describing it as a "desperate attempt to silence our voice." They asserted that such acts of digital aggression only expose the fear instilled in those they oppose. "Their actions only confirm the impact of our mission. The pursuit of justice cannot be stopped by taking down a website; the movement for truth will persist and grow stronger," the hackers stated. Handala's presence has been noted since the recent surge of hostilities following the October 7, 2023 attacks by Hamas, and the group is believed to have connections with the Iranian government. They claimed responsibility for the recent attack on Stryker, which employs over 56,000 workers globally, citing retaliation for a U.S. missile strike that resulted in the tragic loss of lives in Iran, predominantly children. The hack reportedly allowed Handala to infiltrate an internal administrator account at Stryker, granting them extensive access to the company's Windows network. This access enabled the hackers to control Stryker’s Intune dashboards, which manage employee devices and can delete data remotely. Following the breach, Stryker announced that it is in the process of restoring its network and computer systems. Nariman Gharib, a cyber-espionage investigator based in the U.K., commented on the takedown, viewing it as a positive development. He noted that the disruption of Handala's organizational structure might expose its members to potential military actions, similar to other cyber units linked to the Iranian regime. However, he cautioned that this disruption does not necessarily hinder their future activities, suggesting that further leaks could still emerge through channels associated with the IRGC, Iran's military branch.