Cybersecurity — 2026-04-20

DomainTools attributes Handala, Homeland Justice, Karma personas to single MOIS-directed influence ecosystem

DomainTools Investigations published research on 20 April attributing activity long tracked separately under the Handala Hack, Homeland Justice, and Karma/KarmaBelow80 banners to a single coordinated cyber-influence ecosystem aligned with Iran's Ministry of Intelligence and Security. Researchers described the personas as interchangeable operational veneers over a consistent underlying MOIS capability, with Homeland Justice focused on Albania, Karma on Israel, and Handala on broader anti-Western and pro-Palestinian themes. The analysis follows the Justice Department's March seizure of four domains including Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to and builds on earlier Check Point and FDD reporting on Handala's tradecraft.

Analysis
DomainTools' unification of Handala, Homeland Justice, and Karma under a single MOIS operational stack is almost certainly correct, and very likely means Western defenders have been overestimating MOIS operational diversity while underestimating the scale of its dedicated influence cadre, per a single vendor research blog without signals-agency corroboration, though the DOJ seizure affidavits are consistent with the framing. Indicator sharing or blocklists keyed to any one persona probably burns the entire ecosystem for a cycle of weeks, which likely explains the March domain seizures. MOIS will likely spin up replacement cover domains within 30 days and execute a partial tradecraft refresh within 60-90 days; targeted sanctions against identified Iranian contractors, rather than the personas themselves, would produce more durable disruption than further domain seizures.

2 sources

Iran MOIS Tied to Coordinated Cyber Campaign Using Multiple Hacker Personas - GBHackers
Researchers Say Iranian MOIS Uses Multiple Hacker Personas for One Coordinated Cyber Campaign - The Hacker News