Cyber Operations & Adversary IC — 2026-03-27

DOJ Seizes Handala Domains and Offers $10M Reward as Iran Cyber Campaign Expands Against US Targets

The Department of Justice announced the seizure of four domains used by the Handala Hack Team as part of ongoing disruption efforts against MOIS-directed cyber operations. The FBI simultaneously posted a $10 million reward for information identifying Handala operators. The seizures follow a month of escalating Iranian cyber attacks including the March 11 Stryker wiper that destroyed 200,000+ devices across 79 countries and the March 27 breach of FBI Director Patel's personal email. Handala presents as pro-Palestinian hacktivists but is assessed by the DOJ, Israeli cybersecurity researchers, and Western intelligence as a MOIS cyber persona conducting operations retaliating for the Iran war.

Analysis
The $10M reward, matching the FBI's highest reward tiers, signals that Handala is being treated as a strategic adversary, not a hacktivist nuisance. DOJ's formal MOIS attribution closes the ambiguity around Handala's state sponsorship. The escalation from the Stryker wiper (200,000 devices destroyed) to targeting the FBI Director personally follows a clear campaign logic: each operation raises the reputational stakes while demonstrating reach.

1 sources

FBI Director Kash Patel's email hacked by Iran-linked cyber criminals - Washington Times