The U.S. Department of Justice said it seized four websites that were connected to the Iranian regime’s Intelligence and Security Ministry and its “attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks and calling for the killing of journalists, regime dissidents and Israeli persons.”
“Terrorist propaganda online can incite real-world violence,” stated Pamela Bondi, the U.S. attorney general. “This network of Iranian-backed sites will no longer broadcast anti-American hate.”
The four sites are Justicehomeland(.)org, Handala-Hack(.)to, Karmabelow80(.)org, and Handala-Redwanted(.)to. At press time, the URLs returned pages stating that “this website has been seized” with the logos of the Justice Department and the FBI.
“Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans and silence dissidents,” stated Kash Patel, FBI director. “We took down four of their operation’s pillars, and we’re not done. This FBI will hunt down every actor behind these cowardly death threats and cyber attacks and will bring the full force of American law enforcement down on them.”
John Eisenberg, assistant U.S. attorney general for national security, stated that “Iran, the leading state sponsor of terrorism worldwide, used the seized domains to dox and harass dissidents and journalists, incite violence against Jewish communities, and spread Tehran’s anti-American propaganda.”
The Handala-Redwanted site posted the names and sensitive, identifiable information of about 190 people who were associated with or worked for the Israeli military or government on March 9, according to the Justice Department. “The Handala Hack posting contained threats indicating the individuals were being monitored, their residences were known and that consequences would soon follow,” it said.
Three days prior, Handala Hack used the Handala-hack site to post names and confidential information of people it said worked for the Israeli military. “Your iPhone 12 Pro Max holds no security for us. We even know your exact location,” it stated. It directed readers to “see these names and respond to these Zionist pigs yourself.”
Also on March 6, the group used the site to claim that it “stole 851 gigabytes of confidential data from members of the Sanzer Chassidic Jewish community, including ‘documents of financial cooperation, witchcraft ceremonies and secret correspondences with Netanyahu,’” according to the Justice Department. “The post continued, ‘We warn the leaders and members of the Sanzer Chassidic community: No place is safe for you. Betrayal of the oppressed leads to nothing but disgrace and shame. Expect more documents to be revealed. Handala Hack.’”
According to a heavily redacted affidavit from the FBI, the bureau believes the same people are responsible for all four sites.
One of the malware tools the group used was named, evidently, for Israeli Prime Minister Benjamin Netanyahu, the “Bibi wiper.”
The group also stole data from the Albanian government, which a covert FBI agent purchased from the hackers. The hackers also targeted hospitals in Maryland and Iranian dissidents and journalists in the United States.
