# Handala: threat group profile

> Handala is a threat group thought to operate from Palestinian Territories. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/handala
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > Handala

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Thought to operate from | Palestinian Territories |
| Other names | 0 |
| Public reports | 3 |

## Who is Handala?

Handala is a threat group thought to operate from Palestinian Territories. Public reporting about it is still limited.

### What public reporting says

> Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware. The group utilizes a multi-stage loading process, including a Delphi-coded second-stage loader and an AutoIT injector, to deliver wiper malware that specifically targets Windows and Linux environments. Their phishing campaigns often exploit major events and critical vulnerabilities, masquerading as legitimate organizations to gain initial access. Handala operates a data leak site to publicize stolen data, although claims of successful attacks are sometimes disputed by targeted organizations.

## Public reports about Handala

- https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
- https://www.trellix.com/blogs/research/handalas-wiper-targets-israel/
- https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/

## Frequently asked questions

### Who is Handala?

Handala is a threat group thought to operate from Palestinian Territories. Public reporting about it is still limited.

### Where is Handala thought to be based?

Public reporting places Handala as operating from Palestinian Territories. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How do I know if Handala is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact