- Category
- Tracked, unattributed · A vendor’s working cluster, not yet attributed.
- Origin
- Unknown
- Motivation
- Sabotage and destruction
- Seen
- 2023
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0782 · handala-hack-team
What it is
(Intezer) A group calling itself “Handala Hack Team” has claimed responsibility for recent cyber attacks. They present themselves as a newly formed pro-Palestinian activist group, yet their identity behind the social media profiles remains uncertain. Handala Hack has set up various social media accounts, including on Telegram, Tox, Twitter, and BreachForums, and has also launched their own website, which is currently incomplete. As they reported the attacks in real-time, they also mocked the Israel National Cyber Directorate (INCD). Their website’s purpose is still unclear, but it may be intended for publicizing information about hacked targets.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Operations
- Operation “HamsaUpdate”
Targets
- Countries
- Israel
Tools
The tools and malware families the sources tie to it.
- Hamsa Wiper
- Handala
- Hatef Wiper
Sources
- ETDA Threat Group Card apt.etda.or.th