U.S. accuses Iran’s government of operating hacktivist group that hacked Stryker

The U.S. Justice Department has formally accused the Iranian government of orchestrating the hacktivist group known as Handala, which recently claimed responsibility for a significant cyberattack on the American medical technology firm Stryker. In a press release issued on Thursday, officials revealed that Iran's Ministry of Intelligence and Security (MOIS) is behind Handala, describing the group as a deceptive activist front used to conduct 'psychological operations' against perceived adversaries. The Justice Department alleges that Handala has been involved in carrying out cyberattacks, as well as disseminating stolen information obtained through these intrusions. The group has reportedly called for violence against journalists, regime opponents, and individuals associated with Israel. This announcement followed the FBI's seizure of two websites connected to Handala, which were reportedly utilized to showcase the group’s cyber activities and disclose personal information of individuals linked to the Israeli military and defense industry. Handala claimed responsibility for a cyberattack on Stryker that occurred on March 11, during which hackers remotely erased data from tens of thousands of employee devices. They stated that the attack was a form of retaliation for a U.S. airstrike that tragically resulted in the deaths of numerous Iranian children. FBI Director Kash Patel emphasized in the DOJ's announcement that the FBI has dismantled key components of Handala's operations, stating, 'We took down four of their operation’s pillars and we’re not done.' In addition to the two websites linked to Handala, the DOJ also confiscated two other domains allegedly associated with another hacktivist group dubbed 'Justice Homeland,' which is also believed to be connected to Iran’s MOIS. This group is accused of claiming responsibility for a cyber assault on the Albanian government in 2022, which resulted in government servers being compromised and sensitive data being stolen. Microsoft has corroborated the connection between the Albanian attack and the Iranian Ministry of Intelligence. In a court affidavit supporting the seizure of Handala's websites, the FBI indicated that Handala, Justice Homeland, and another hacktivist group called Karma Below are part of a coordinated effort operated by the same individuals. In response to the DOJ's actions, Handala issued a statement through its official Telegram channel, denouncing the U.S. government’s maneuvers as desperate attempts to suppress their voice. Cybersecurity expert Keith O’Neill from DomainTools noted that Handala has already established new domains that remain active despite the seizures. Attempts to reach out to Handala for additional comments went unanswered, and the Iranian Permanent Mission to the United Nations also did not respond to inquiries. Experts suggest that the individuals behind the Handala persona may not necessarily be the same as those executing the hacking operations, highlighting the complex nature of such cyber activities.