Handala sent threatening WhatsApp messages to US service members in Bahrain and doxxed 2,379 Marine Corps personnel, marking an escalation in psychological operations tied to Iran’s Ministry of Intelligence.
The Iran-linked threat actor Handala targeted US troops in Bahrain this week in an influence campaign carried out via WhatsApp, according to multiple reports. The messages, signed by Handala and containing a link to the group’s website, claimed service members were under surveillance and would soon be targeted with Shahed drones and Kheibar and Ghadeer missiles. The group also boasted on its Telegram channel about publishing personal information of 2,379 US Marine Corps members stationed in the Persian Gulf.
Also tracked as Handala Hack, Banished Kitten, and Void Manticore, Handala has been active since at least 2008, engaging in a broad range of activities from hacktivism to destructive attacks. In March 2026, the US officially linked Handala to Iran’s Ministry of Intelligence and Security (MOIS) following a disruptive attack on medical technology giant Stryker that wiped over 200,000 systems using compromised administrator credentials in Microsoft Intune. According to SOCRadar, Handala’s association with MOIS rather than the IRGC suggests the group operates more as an intelligence and influence operation than a purely military one.
The group also claimed to have hacked FBI Director Kash Patel’s personal Gmail account, which the US confirmed and responded with a $10 million reward for information leading to the identification and arrest of Handala members. Using custom malware, commercial tools, and wipers including BiBi Wiper, CoolWipe, ChillWipe, and Hamsa, Handala previously targeted Israeli organizations ranging from kindergartens to nuclear research centers. The group leverages the Telegram Bot API for command-and-control communication.
SOCRadar notes that the group operates inside a larger Iranian intelligence structure, gets initial network access handed to it by more sophisticated actors, and has shown it can cause significant operational damage when it reaches its target. The shift toward directly threatening military personnel through personal communication channels marks a troubling escalation beyond corporate or infrastructure targets.
Source: SecurityWeek — Iranian Cyber Group Handala Targets US Troops in Bahrain in WhatsApp I
