Cyber Operations & Adversary IC — 2026-04-01

Iran APT Claims 375TB Lockheed Martin Breach; Handala Doxxes Engineers and Demands $400M Ransom

APT Iran claims to have exfiltrated 375TB from Lockheed Martin systems, including alleged F-35 blueprints, demanding $400M ransom later raised to $598M. In a coordinated second phase, Handala published personal data of 28 senior Lockheed engineers working in Israel with 48-hour evacuation ultimatums. Lockheed Martin states there is no evidence of impact to its systems. The FBI has seized Handala domains, though the group rapidly restored operations.

Analysis
Lockheed denies any breach, creating a source tension. If APT Iran did exfiltrate F-35 data, the counterintelligence implications extend well beyond one company; the F-35 supply chain spans 1,700+ suppliers across allied nations. The $400M-to-$598M ransom escalation mirrors Stryker wiper tactics, suggesting MOIS is testing whether wartime cyber operations can generate both intelligence and revenue simultaneously. No independent technical verification of the claimed 375TB exfiltration exists; the claim rests entirely on attacker assertions.

2 sources