IranWire
Attack Intelligence
IranWire was compromised in a ransomware attack attributed to handala in March 2026. The organization, operating in an undisclosed sector in IR, was added to the group's data leak site as part of an extortion campaign.
handala operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
In line with its committed responsibility and dedication to the ideals of the Axis of Resistance, the Handala Cyber Group has successfully carried out a complex and targeted operation, fully hacking and taking control of the hostile outlet IranWire, which was allegedly operating under the direct guidance and support of the CIA. A vast volume…