FBI: Handala Hack and Homeland Justice are run by the same MOIS actors
Assessment
In the affidavit supporting the March 2026 seizure warrant for four Iran-linked domains, the FBI's investigation concluded that Handala Hack and the separate "Homeland Justice" hacktivist persona are both operated by Iran's MOIS and are linked through shared leak-site infrastructure, overlapping Iranian IP ranges, and a common operational "playbook" of destructive attacks paired with faketivist psychological operations. This is presented by DOJ/FBI as an investigative conclusion based on infrastructure analysis, not a confession or court-tested fact — it carries the confidence of a law-enforcement attribution, not independent forensic corroboration from a third party. Readers may see "Handala Hack" and "Homeland Justice" treated as fully interchangeable in secondary coverage when the underlying claim is a specific, sourced government assessment.
Where this claim appeared
US Department of Justice, Office of Public Affairs · 2026-03-19
https://www.justice.gov/opa/pr/justice-department-disrupts-iranian-cyber-enabled-psychological-operationsWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2Think this assessment is wrong? Report an error.