U.S. accuses Iran’s government of operating ...

The U.S. Justice Division accused Iran’s authorities of being behind the hacktivist group Handala, which final week claimed responsibility for the destructive cyberattack in opposition to the U.S. medical tech big Stryker. 

In a press release revealed on Thursday, the Justice Division stated Iran’s Ministry of Intelligence and Safety (MOIS) is working Handala. 

The Justice Division referred to as the group a faux activist persona that the Iranian ministry used to hold out “psychological operations” in opposition to the regime’s enemies, to assert duty for cyberattacks, and to publish stolen data obtained throughout these hacks. The group additionally referred to as for the killing of journalists, regime dissidents, and Israeli individuals, per the DOJ. 

The announcement got here hours after the FBI seized two websites linked to Handala, as first reported by TechCrunch. The group used the web sites to publicize its alleged cyberattacks, in addition to to publish the non-public data of dozens of people that allegedly labored for the Israeli army and protection contractors. 

Handala took credit score on its web site for the March 11 cyberattack on Stryker, throughout which the hackers remotely wiped tens of thousands of employee devices. The hackers stated the breach was in retaliation for a U.S. air strike on an Iranian faculty, killing dozens of kids.

FBI director Kash Patel was quoted within the DOJ’s press launch as saying that the FBI “took down 4 of their operation’s pillars and we’re not carried out.”

Other than the 2 web sites utilized by Handala, the DOJ additionally seized two different domains allegedly utilized by Iran’s MOIS through one other hacktivist persona calling themselves “Justice Homeland” or “Homeland Justice.” The DOJ accused Iranian authorities hackers of utilizing these two domains to assert duty for hacking the Albanian authorities in 2022, in a cyberattack that resulted in authorities servers being taken offline and the theft of delicate information. Microsoft additionally linked the attack in opposition to the Albanian authorities to the MOIS.

In an affidavit submitted in courtroom to help the seizure of Handala’s web sites, the FBI stated that Handala, Justice Homeland, and one other hacktivist persona referred to as Karma Beneath, “are a part of the identical conspiracy as a result of they’re operated by the identical people.”

Handala responded to the DOJ’s announcement in an announcement posted on its official Telegram channel, the place the hackers referred to as the U.S. authorities actions “nothing greater than the newest determined makes an attempt by the US and its allies to silence the voice of Handala.”

DomainTools’ cybersecurity researcher Keith O’Neill instructed TechCrunch that Handala has already arrange new domains that haven’t but been seized.

The hacking group didn’t reply to a request for remark despatched to a chat account publicized by the hackers, in addition to an e-mail handle recognized by the Justice Division in its affidavit. 

A spokesperson for Iran’s Everlasting Mission to the United Nations didn’t reply to TechCrunch’s request for remark. Stryker additionally didn’t reply to a request for remark.

Alex Orleans, the pinnacle of menace intelligence at Elegant Safety who has tracked Iranian hackers for years, instructed TechCrunch that it’s doable that the individuals behind the Handala persona usually are not the identical people doing the precise hacking. 

“Handala doesn’t essentially equate, one-to-one, with the actors conducting the actions it’s taking credit score for,” stated Orleans. “There might be a number of groups conducting precise intrusions whereas a definite workforce is accountable for sustaining the persona — with all of those distinct components coexisting inside a bigger unified MOIS aspect.”

“There’s a stage of opacity there that may be tough to penetrate,” he stated.