FortiGuard Labs Outbreak Alert for Handala
FortiGuard Labs has published an Outbreak Alert for Handala, an Iran-linked threat group, covering ongoing exploitation of critical vulnerabilities across Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products.
The alert describes a live campaign rather than a single CVE drop or one-day exploit release. FortiGuard characterizes the activity as sustained exploitation of known high-impact flaws in widely deployed enterprise and OT/IT stacks, consistent with Handala’s recent pattern of pairing intrusion with wiper and data-leak operations.
Who is Handala
Handala is a state-directed front for Iran’s Ministry of Intelligence and Security (MOIS), operating as a hacktivist-style persona with a dedicated leak site and Telegram channel. Palo Alto Networks Unit 42 and Check Point have both profiled the group, and FortiGuard maintains a dedicated threat actor page for it.
What the alert covers
Six product families are in scope: Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti. The alert is an Outbreak Alert, meaning FortiGuard is seeing active exploitation in the wild, not just a patch drop. No CVE is referenced in this specific alert; the group is running the exploits against the listed products.
The wiper and the toolset
Handala Wiper is the destructive payload in the stack. It is a standalone script that runs directly on the target, not a traditional malware binary delivered to endpoints. That is why EDRs missed it: there is no conventional payload to detect, just a script that wipes the device. In the Stryker operation, it wiped tens of thousands of devices across the medical technology company’s environment.
MarkiRAT and Seedworm round out the toolset. MarkiRAT handles C2 and remote access, while Seedworm provides persistence. The three-piece set covers the full lifecycle: initial access, command-and-control, and destructive execution. No separate CVE is referenced in this alert; the group runs the exploits directly against the listed product families.
Who was hit
Stryker, the US medical technology company, was the headline wiper target. Handala’s standalone script wiped tens of thousands of devices across the company’s environment, a payload that runs directly on the target rather than a conventional malware binary delivered to endpoints. That is why EDRs missed it: there is no traditional payload to detect, just a script that wipes the device.
North Country Business Products, a US-based point-of-sale provider serving major retail chains nationwide, was claimed on Handala’s leak site on 28 March 2026. The group alleges it disrupted approximately 2,680 POS terminals.
Hikvision security cameras across the Middle East were exploited for real-time surveillance. Check Point researchers observed the exploitation following the US and Israeli air strikes, with the geographic footprint spanning the region. The compromised cameras supported real-time surveillance during the military operations.
Key points
- FortiGuard Labs published an Outbreak Alert for the Handala group, an Iran-linked threat actor.
- The alert covers active exploitation of critical vulnerabilities in Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products.
- Handala is part of a broader MOIS-linked persona system alongside Homeland Justice and Karma, used for intrusion, wiper, and leak operations.
- The group has been active since March 2026, with a wiper attack, CISA advisory, and infrastructure seizure by the U.S. DOJ.
- No CVE is referenced in this specific alert; the six vendor products are named in the FortiGuard Outbreak Alert.