{
	"id": "84537cd5-1b1e-47fc-8587-6a60362ce096",
	"created_at": "2026-04-06T00:11:40.3574Z",
	"updated_at": "2026-04-10T03:31:42.923921Z",
	"deleted_at": null,
	"sha1_hash": "9b43fc8cbb7788a12665d06099cbeeb806432942",
	"title": "Handala Hack Team - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44577,
	"plain_text": "Handala Hack Team - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 22:42:22 UTC\nHome \u003e List all groups \u003e Handala Hack Team\n Other threat group: Handala Hack Team\nNames Handala Hack Team (self given)\nCountry [Unknown]\nMotivation Sabotage and destruction\nFirst seen 2023\nDescription\n(Intezer) A group calling itself “Handala Hack Team” has claimed responsibility for\nrecent cyber attacks. They present themselves as a newly formed pro-Palestinian\nactivist group, yet their identity behind the social media profiles remains uncertain.\nHandala Hack has set up various social media accounts, including on Telegram, Tox,\nTwitter, and BreachForums, and has also launched their own website, which is\ncurrently incomplete. As they reported the attacks in real-time, they also mocked the\nIsrael National Cyber Directorate (INCD). Their website’s purpose is still unclear,\nbut it may be intended for publicizing information about hacked targets.\nObserved Countries: Israel.\nTools used Hamsa Wiper, Handala, Hatef Wiper.\nOperations performed Dec 2023\nOperation “HamsaUpdate”\nOperation HamsaUpdate: A Sophisticated Campaign Delivering\nWipers Puts Israeli Infrastructure at Risk\nInformation Last change to this card: 16 January 2024\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=17ec4f3c-1ded-44fb-9f0e-5c07c8096421\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=17ec4f3c-1ded-44fb-9f0e-5c07c8096421\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=17ec4f3c-1ded-44fb-9f0e-5c07c8096421"
	],
	"report_names": [
		"showcard.cgi?u=17ec4f3c-1ded-44fb-9f0e-5c07c8096421"
	],
	"threat_actors": [
		{
			"id": "d0fef355-9eb9-4adc-8d90-a8c7494c4a81",
			"created_at": "2024-01-18T02:02:34.735032Z",
			"updated_at": "2026-04-10T02:00:05.011663Z",
			"deleted_at": null,
			"main_name": "Handala Hack Team",
			"aliases": [
				"Operation HamsaUpdate"
			],
			"source_name": "ETDA:Handala Hack Team",
			"tools": [
				"Hamsa Wiper",
				"Handala",
				"Hatef Wiper"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "4134675e-5b72-4b50-8d70-1a8f18aafbb4",
			"created_at": "2024-10-04T02:00:04.766263Z",
			"updated_at": "2026-04-10T02:00:03.715945Z",
			"deleted_at": null,
			"main_name": "Handala",
			"aliases": [],
			"source_name": "MISPGALAXY:Handala",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b3ebf51d-8f64-48a9-bbfb-674db872cccb",
			"created_at": "2025-08-07T02:03:24.769383Z",
			"updated_at": "2026-04-10T02:00:03.860954Z",
			"deleted_at": null,
			"main_name": "COBALT MYSTIQUE",
			"aliases": [
				"Banished Kitten ",
				"DEV-0842 ",
				"Druidfly ",
				"Handala Hack Team",
				"Homeland Justice",
				"Karmabelow80",
				"Red Sandstorm ",
				"Storm-0842 ",
				"Void Manticore "
			],
			"source_name": "Secureworks:COBALT MYSTIQUE",
			"tools": [
				"AllinOneNeo",
				"Bibi",
				"GramPy",
				"GramPyLoader"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434300,
	"ts_updated_at": 1775791902,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9b43fc8cbb7788a12665d06099cbeeb806432942.pdf",
		"text": "https://archive.orkl.eu/9b43fc8cbb7788a12665d06099cbeeb806432942.txt",
		"img": "https://archive.orkl.eu/9b43fc8cbb7788a12665d06099cbeeb806432942.jpg"
	}
}