IRANIAN CYBER PSYCHOLOGICAL OPERATIONS DISRUPTED — FEDERAL DOMAIN SEIZURES TARGET STATE-LINKED HACKING, DOXXING, AND THREAT NETWORKS

Court-authorized action removes infrastructure tied to Iranian intelligence operations combining cyber intrusion claims, data exposure, and transnational intimidation campaigns

A federal cyber enforcement action has resulted in the seizure of four internet domains linked to operations attributed to the Islamic Republic of Iran’s Ministry of Intelligence and Security (MOIS), targeting infrastructure used to conduct cyber-enabled psychological operations, data exposure campaigns, and coordinated threats against individuals and entities across multiple regions.

The seized domains—Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to—were identified as components of an operational network used to publish data obtained through hacking activity, claim responsibility for cyberattacks, and distribute messaging intended to intimidate adversaries of the Iranian government.

According to investigative findings, the domains were interconnected through shared infrastructure, including overlapping IP ranges, coordinated content distribution, and a common operational methodology. That methodology included both destructive cyberattack claims and the use of fabricated or amplified “hacktivist” personas aligned with state-directed objectives.

Following the escalation of tensions beginning on February 28, 2026, activity associated with the domains intensified, including the publication of personally identifiable information tied to targeted individuals and the issuance of direct threats.

On March 11, 2026, the domain Handala-Hack[.]to was used to claim responsibility for a destructive malware attack against a U.S.-based multinational medical technology company, presenting the activity as retaliation within a broader geopolitical conflict framework.

On March 9, 2026, the domain Handala-Redwanted[.]to published the names and sensitive personal information of approximately 190 individuals associated with or employed by the Israeli Defense Force and Israeli government. The posting included statements indicating the individuals were being monitored and that consequences would follow.

On March 6, 2026, the Handala-Hack[.]to domain was used to release names and confidential data tied to individuals alleged to be associated with Israeli defense structures, accompanied by messaging asserting surveillance capabilities and urging external actors to respond.

The same day, the domain claimed to have obtained 851 gigabytes of data associated with members of a Hasidic Jewish community, including documents described as financial records and private correspondence. The messaging accompanying the release included threats directed at community members and warnings of additional disclosures.

In addition to publicly posted material, investigators identified an associated email account used to send direct threats to Iranian dissidents and journalists located in the United States and abroad. Communications sent from that account included explicit threats of violence and references to external criminal organizations, including the Jalisco New Generation Cartel, in an effort to amplify perceived enforcement capability.

The domains Justicehomeland[.]org and Karmabelow80[.]org were identified as official platforms for a constructed hacktivist entity used by MOIS. These platforms were previously used to claim responsibility for data breaches involving Albanian government organizations in 2022, following Albania’s support for an Iranian dissident group known as Mujahedeen e-Khalq.

The operational structure of the network reflects a hybrid model combining cyber intrusion, information warfare, and psychological pressure tactics. By pairing data exposure with targeted messaging and threat amplification, the network sought to influence behavior, intimidate individuals, and project operational reach beyond its physical jurisdiction.

The court-authorized seizure removes these domains from active use, disrupting the ability to publish content, coordinate messaging, and distribute threats through those channels.

The investigation is being conducted by the FBI’s Baltimore Field Office in coordination with the FBI Cyber Division, with prosecution handled by federal authorities specializing in national security and cyber operations.

The enforcement action reflects ongoing efforts to identify and disrupt cyber-enabled operations conducted by foreign state actors targeting individuals, institutions, and critical infrastructure.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---