U.S. Shuts Down Websites Behind Iran-Linked Cyber Attacks and Death Threats

The U.S. Justice Department seized four domains tied to Iran’s Ministry of Intelligence and Security (MOIS), disrupting a state-backed campaign that combined cyberattacks, data leaks, and online intimidation. The operation used fake hacktivist fronts to publish stolen data and directly threaten journalists, dissidents, and individuals linked to Israel, signaling a shift toward visibility-driven, person-targeted attacks. #MOIS #Handala-hack

Keypoints

Four domains tied to Iran’s MOIS were seized: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to.
Authorities say the sites used shared Iranian infrastructure and leak platforms while posing as hacktivist groups.
The campaign combined disruptive cyberattacks with public claims of responsibility and large-scale data thefts, including a March 2026 attack on a U.S. medical technology company.
Operators published identifying details of nearly 190 individuals linked to the Israeli Defense Force and issued direct threats against journalists, dissidents, and community members.
The Justice Department’s takedown aims to disrupt the infrastructure, but officials warn that visibility-driven, person-targeted tactics by Iran-linked actors are evolving and likely to persist.