{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/actors/mois/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["MOIS"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["iran","mois","handala","physical-threat","influence-operations"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eIran\u0026rsquo;s Ministry of Intelligence (MOIS) has expanded the use of its \u0026ldquo;Handala\u0026rdquo; brand to include external physical and influence operations targeting US and Israeli interests. The Handala Hack Team, referring to itself as the \u0026ldquo;Handala Popular Resistance Front\u0026rdquo; (HPRF), shares online activities with three previously identified influence operations networks. These groups are now attributed to MOIS, with varying degrees of confidence. The administrators solicit individuals to conduct physical attacks and espionage targeting US and Israeli entities on behalf of Iranian intelligence agencies, for financial reward. MOIS seeks to leverage Handala\u0026rsquo;s global recognition to amplify its solicitation efforts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMOIS establishes the \u0026ldquo;Handala Popular Resistance Front\u0026rdquo; (HPRF) as a branded persona.\u003c/li\u003e\n\u003cli\u003eHPRF and associated influence networks solicit individuals for physical attacks and espionage against US and Israeli entities.\u003c/li\u003e\n\u003cli\u003eRecruits are offered financial rewards for their participation in the operations.\u003c/li\u003e\n\u003cli\u003eRecruits conduct reconnaissance on targeted individuals, facilities, or organizations.\u003c/li\u003e\n\u003cli\u003eRecruits plan and execute physical attacks, espionage, or sabotage.\u003c/li\u003e\n\u003cli\u003eHPRF provides operational guidance and potential resources to the recruited individuals.\u003c/li\u003e\n\u003cli\u003eSuccessful operations are publicized to amplify the Handala brand.\u003c/li\u003e\n\u003cli\u003eMOIS leverages the increased brand recognition to attract more recruits for future operations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eMOIS\u0026rsquo;s coordination of cyber, physical, and influence operations under the Handala brand amplifies threats to targeted individuals and facilities. Handala-linked physical threat actors could leverage the brand\u0026rsquo;s recognition to recruit individuals for targeted violent attacks, espionage, sabotage, or other physical threat activities. This entails heightened risks for US and Israeli law enforcement, military, and intelligence agencies and their personnel, in addition to energy, transportation, and research organizations operating in the region.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor social media and online forums for mentions of the \u0026ldquo;Handala Popular Resistance Front\u0026rdquo; to identify potential recruitment activities (content).\u003c/li\u003e\n\u003cli\u003eImplement enhanced security measures at US and Israeli law enforcement, military, and intelligence facilities (Impact).\u003c/li\u003e\n\u003cli\u003eEstablish threat hunting for individuals expressing interest in conducting attacks, espionage, or sabotage against US and Israeli interests (Attack Chain).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-06-02T13:57:08Z","date_published":"2026-06-02T13:57:08Z","id":"https://feed.craftedsignal.io/briefs/2026-06-handala-physical-threats/","summary":"Iran's MOIS has broadened the Handala brand to encompass physical threat operations, recruiting proxies to conduct attacks, espionage, and sabotage against US and Israeli interests, amplifying both cyber and physical threats.","title":"Iran's MOIS Expands Handala Brand to Physical Threat Operations","url":"https://feed.craftedsignal.io/briefs/2026-06-handala-physical-threats/"}],"language":"en","title":"CraftedSignal Threat Feed — MOIS","version":"https://jsonfeed.org/version/1.1"}