GINC-APT-0782 · Tracked, unattributed

Handala Hack Team

Also Operation “HamsaUpdate”.

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Motivation
Sabotage and destruction
Seen
2023
Sources
3 sources carry it
Identifier
GINC-APT-0782 · handala-hack-team

What it is

(Intezer) A group calling itself “Handala Hack Team” has claimed responsibility for recent cyber attacks. They present themselves as a newly formed pro-Palestinian activist group, yet their identity behind the social media profiles remains uncertain. Handala Hack has set up various social media accounts, including on Telegram, Tox, Twitter, and BreachForums, and has also launched their own website, which is currently incomplete. As they reported the attacks in real-time, they also mocked the Israel National Cyber Directorate (INCD). Their website’s purpose is still unclear, but it may be intended for publicizing information about hacked targets.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Operations
Operation “HamsaUpdate”

Targets

Countries
Israel

Tools

The tools and malware families the sources tie to it.

  • Hamsa Wiper
  • Handala
  • Hatef Wiper

Sources