Handala
- Origin
- PS
- Primary motivation
- ideology
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- hacktivist
- Profile updated
- 2026-07-07 12:17:51
Targeted industries: government-and-public-sector energy-and-utilities financial-services
Targeted regions: country_code:il
Context
Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware. The group utilizes a multi-stage loading process, including a Delphi-coded second-stage loader and an AutoIT injector, to deliver wiper malware that specifically targets Windows and Linux environments. Their phishing campaigns often exploit major events and critical vulnerabilities, masquerading as legitimate organizations to gain initial access. Handala operates a data leak site to publicize stolen data, although claims of successful attacks are sometimes disputed by targeted organizations.
Reports & references
- splunk.com — Handalas Wiper Threat Analysis And Detections (report)
- trellix.com — Handalas Wiper Targets Israel (report)
- intezer.com — Stealth Wiper Israeli Infrastructure (report)