Handala
Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware. The group utilizes a multi-stage loading process, including a Delphi-coded second-stage loader and an AutoIT injector, to deliver wiper malware that specifically targets Windows and Linux environments. Their phishing campaigns often exploit major events and critical vulnerabilities, masquerading as legitimate organizations to gain initial access. Handala operates a data leak site to publicize stolen data, although claims of successful attacks are sometimes disputed by targeted organizations.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- DomainTools Investigations | MrHex: A New Hack and Leak Campaign Attributing Themselves to Handala https:// infosec.pub/post/54394337 [ https:// infosec.pub/u/dmastodon · Nov 2, 2026
- DomainTools Investigations | MrHex: A New Hack and Leak Campaign Attributing Themselves to Handalareddit · Nov 2, 2026
- MrHex: A New Hack and Leak Campaign Attributing Themselves to Handala https:// packetstorm.news/news/view/467 29 # newsmastodon · Oct 29, 2026
References
- https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
- https://www.trellix.com/blogs/research/handalas-wiper-targets-israel/
- https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/
- https://www.ransomlook.io/group/handala
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.