[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXDtxXrNFKyX1QMSvqYrlaAOe9t9T-HuDbZjQnyn3pGE":3,"$fUUfr5uEZyKWzzqB8S_WdEy3HS-T6cL2SHkzr_iJuvp8":81},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":20,"hero_image_url":21,"structured":22,"story_type":78,"created_at":79,"updated_at":80,"published_at":28},"fortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir","FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign","Outbreak Alert covers Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products in ongoing Iran-linked operations.","FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.",[10,11,12,13,14,15,16,17,18,19],"Handala","FortiGuard","Iran","Outbreak Alert","Microsoft","Oracle","Apache","Hikvision","Atlassian","Ivanti","# FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign\n\n*Outbreak Alert covers Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products in ongoing Iran-linked operations.*\n\n**Tags:** `Handala` `FortiGuard` `Iran` `Outbreak Alert` `Microsoft` `Oracle` `Apache` `Hikvision` `Atlassian` `Ivanti`\n\n> FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.\n\n---\n\n## FortiGuard Labs Outbreak Alert for Handala\n\nFortiGuard Labs has published an Outbreak Alert for Handala, an Iran-linked threat group, covering ongoing exploitation of critical vulnerabilities across Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products.\n\nThe alert describes a live campaign rather than a single CVE drop or one-day exploit release. FortiGuard characterizes the activity as sustained exploitation of known high-impact flaws in widely deployed enterprise and OT\u002FIT stacks, consistent with Handala’s recent pattern of pairing intrusion with wiper and data-leak operations.\n\n## Who is Handala\n\nHandala is a state-directed front for Iran’s Ministry of Intelligence and Security (MOIS), operating as a hacktivist-style persona with a dedicated leak site and Telegram channel. Palo Alto Networks Unit 42 and Check Point have both profiled the group, and FortiGuard maintains a dedicated threat actor page for it.\n\n## What the alert covers\n\nSix product families are in scope: Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti. The alert is an Outbreak Alert, meaning FortiGuard is seeing active exploitation in the wild, not just a patch drop. No CVE is referenced in this specific alert; the group is running the exploits against the listed products.\n\n## The wiper and the toolset\n\nHandala Wiper is the destructive payload in the stack. It is a standalone script that runs directly on the target, not a traditional malware binary delivered to endpoints. That is why EDRs missed it: there is no conventional payload to detect, just a script that wipes the device. In the Stryker operation, it wiped tens of thousands of devices across the medical technology company’s environment.\n\nMarkiRAT and Seedworm round out the toolset. MarkiRAT handles C2 and remote access, while Seedworm provides persistence. The three-piece set covers the full lifecycle: initial access, command-and-control, and destructive execution. No separate CVE is referenced in this alert; the group runs the exploits directly against the listed product families.\n\n## Who was hit\n\nStryker, the US medical technology company, was the headline wiper target. Handala’s standalone script wiped tens of thousands of devices across the company’s environment, a payload that runs directly on the target rather than a conventional malware binary delivered to endpoints. That is why EDRs missed it: there is no traditional payload to detect, just a script that wipes the device.\n\nNorth Country Business Products, a US-based point-of-sale provider serving major retail chains nationwide, was claimed on Handala’s leak site on 28 March 2026. The group alleges it disrupted approximately 2,680 POS terminals.\n\nHikvision security cameras across the Middle East were exploited for real-time surveillance. Check Point researchers observed the exploitation following the US and Israeli air strikes, with the geographic footprint spanning the region. The compromised cameras supported real-time surveillance during the military operations.\n\n## Key points\n\n- FortiGuard Labs published an Outbreak Alert for the Handala group, an Iran-linked threat actor.\n- The alert covers active exploitation of critical vulnerabilities in Microsoft, Oracle, Apache, Hikvision, Atlassian, and Ivanti products.\n- Handala is part of a broader MOIS-linked persona system alongside Homeland Justice and Karma, used for intrusion, wiper, and leak operations.\n- The group has been active since March 2026, with a wiper attack, CISA advisory, and infrastructure seizure by the U.S. DOJ.\n- No CVE is referenced in this specific alert; the six vendor products are named in the FortiGuard Outbreak Alert.\n\n## Further reading & sources\n\n- [Iran-linked Cyber Attacks | Outbreak Alert | FortiGuard Labs](https:\u002F\u002Ffortiguard.fortinet.com\u002Foutbreak-alert\u002Firan-linked-cyber-attacks) — FortiGuard Outbreak Alerts\n- [Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters | SentinelOne](https:\u002F\u002Fwww.sentinelone.com\u002Flabs\u002Firan-war-cyber-threat-landscape-a-midyear-assessment-on-what-matters)\n- [The Escalating Cyber Risk Landscape in Regional Conflicts & Strategic Actions for 2026](https:\u002F\u002Fblog.eclecticiq.com\u002Fthe-escalating-cyber-risk-landscape-in-regional-conflicts-strategic-actions-for-2026)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir.png?v=6da17f1ec2",{"actors":23,"malware":33,"targets":40,"timeline":51,"industries":63,"technologies":67},[24,30],{"url":25,"name":10,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fhandala","handala","ransomware",null,"ideological",{"url":31,"name":32,"slug":32,"type":27,"origin":28,"motivation":28},"\u002Fthreat-groups\u002Fkarma","karma",[34,36,38],{"name":35},"MarkiRAT",{"name":37},"Seedworm",{"name":39},"Handala Wiper",[41,46],{"name":42,"sector":43,"status":44,"geography":45},"Stryker","Healthcare\u002FManufacturing","confirmed","Global",{"name":47,"sector":48,"status":49,"geography":50},"North Country Business Products","retail","claimed","US",[52,56,60],{"date":53,"event":54,"description":55},"2026-03-11","Attack","Destructive attack on Stryker claimed by Handala",{"date":57,"event":58,"description":59},"2026-03-19","Report","FortiGuard Labs released Threat Signal related to Handala Wiper Attack.",{"date":61,"event":58,"description":62},"2026-03-31","FortiGuard Labs published Threat Actor profile of Handala (Iran Linked Group)",[64],{"url":65,"name":66,"slug":48},"\u002Findustries\u002Fretail","Retail",[68,70,71,72,74,75,77],{"vendor":14,"product":69},"Environment (Stryker)",{"vendor":15,"product":15},{"vendor":17,"product":17},{"vendor":14,"product":73},"Windows",{"vendor":16,"product":16},{"vendor":18,"product":76},"Confluence",{"vendor":19,"product":19},"threat_actor_activity","2026-08-31T12:10:30.775227+00:00","2026-10-16T12:28:59.446904+00:00",{"articles":82},[83,94,107,119],{"slug":84,"title":85,"summary":86,"tags":87,"hero_image_url":92,"story_type":78,"created_at":93},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater Disguises Espionage Campaign as Chaos Ransomware","MuddyWater used Chaos ransomware branding to mask a state-sponsored espionage operation that included credential theft, data exfiltration, and a leak-site entry, with initial access delivered through Microsoft Teams social engineering.",[88,89,90,91,12],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00",{"slug":95,"title":96,"summary":97,"tags":98,"hero_image_url":105,"story_type":78,"created_at":106},"fortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-","FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets","FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.",[99,100,12,101,102,103,104],"UNC1549","FortiGuard Labs","spear-phishing","VDI","CVE-2021-26855","CVE-2020-0688","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-.png?v=31f9fd4fc4","2026-08-31T07:09:49.726163+00:00",{"slug":108,"title":109,"summary":110,"tags":111,"hero_image_url":117,"story_type":78,"created_at":118},"sentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence","SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence","SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.",[112,12,113,114,115,116],"APT42","MOIS","IRGC","TAMECAT","Spear Phishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence.png?v=3a584a829a","2026-08-29T12:17:25.675495+00:00",{"slug":120,"title":121,"summary":122,"tags":123,"hero_image_url":128,"story_type":78,"created_at":129},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories","TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.",[124,125,126,14,127],"TeamPCP","supply-chain","GitHub","Azure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163","2026-08-26T17:02:14.429711+00:00"]