Who are Handala? Everything you need to know about hacktivist group behind Stryker

The recent cyberattacks on international medical technology giant Stryker and the Hebrew Language Academy are claimed by the hacking group Handala.

Handala is described as a pro-Palestinian hacktivist group associated with a series of disruptive cyber operations targeting Israeli and international organisations.

Comprehensive threat intelligence reported that Handala (also tracked as Void Manticore and BANISHED KITTEN by firms such as Check Point and CrowdStrike) is believed to be linked to Iran’s Ministry of Intelligence and Security (MOIS).

The group’s modus operandi involves combining technical intrusion with aggressive information warfare, which is intended to cause disruption and reputational damage.

Handala usually attacks using sophisticated phishing emails but exploits events to lure victims. Once entering the system, they usually employ custom “wiper” malware that is designed specifically to permanently destroy data, instead of just encrypting data for ransom.

The group is also seen to use commercial file-sharing services such as Mega and Storj to host malicious payloads, making them harder to block.

Recently, the hacking group claimed responsibility of attacking on the Academy of the Hebrew Language and Stryker’s global operations amid U.S.-Israeli attacks on Iran.

The name Handala is derived from the national symbol and personification of the Palestinian people.

The political cartoonist Naji al-Ali first created the character in 1969.