Iran Expands Handala Brand to Physical Threats

MITRE Techniques

• [T1586 ] Compromise Accounts – The actors likely used stolen or controlled accounts and Telegram personas to operate across networks and amplify claims (‘cross-posting of claims and content between Handala Hack Team and these four additional entities’).
• [T1589 ] Gather Victim Identity Information – The groups collected and shared sensitive details about targets, including officials, personnel, and facilities (‘surveilled Israeli military and intelligence personnel’ and ‘shared traffic patterns and sensitive intelligence’).
• [T1591 ] Gather Victim Org Information – The personas collected information about organizations and facilities for targeting and intimidation (‘data from Israel’s Soreq and Dimona nuclear facilities’ and ‘internal communications, blueprints’).
• [T1595 ] Active Scanning – The reporting describes surveillance and reconnaissance of targets before attacks (‘conducted a “surveillance and tail operation”’ and ‘claimed to have surveilled’).
• [T1657 ] Data Destruction – Handala-linked groups used wipers and destructive actions to damage systems or create chaos (‘deployed ransomware’ and ‘wiper attacks’).
• [T1485 ] Data Destruction – Destructive malware and data leak operations were used to harm victims and publicize stolen information (‘destructive malware called the “BiBi wiper”’ and ‘publicly leaking information’).
• [T1566 ] Phishing – The report notes credential abuse and spearphishing-driven access patterns associated with the broader threat activity (‘mitigating credential abuse and spearphishing-driven initial access’).
• [T1090 ] Proxy – VIPEmployment recruited individuals outside Iran to act as proxies for physical attacks and espionage (‘soliciting proxies outside Iran to conduct attacks’).
• [T1203 ] Exploitation for Client Execution – The mitigation section references active exploitation of vulnerabilities to gain access (‘counter exploitation of zero-days and supply-chain vulnerabilities’).
• [T1027 ] Obfuscated Files or Information – The report notes obfuscated binaries as part of defensive detection concerns, reflecting the actors’ use of concealment in tooling (‘obfuscated binaries’).
• [T1041 ] Exfiltration Over C2 Channel – The report describes encrypted command-and-control and unauthorized transmissions of sensitive information (‘inspect encrypted C2 traffic’ and ‘detect unauthorized transmissions of sensitive information’).
• [T1110 ] Brute Force – Not explicitly described as an attack method, but the solicitation and bot-based recruitment infrastructure indicate broad attempts to gain access to assets and people; no direct quote in the article supports this as a confirmed technique.