Researchers Link MOIS To Coordinated Hacker Persona Operation

Researchers attribute a coordinated, MOIS-aligned cyber influence ecosystem—operating under the personas Homeland Justice, Karma, and Handala—to Iran’s Ministry of Intelligence and Security. The assessment links these personas to exploitation of a Microsoft SharePoint vulnerability, deployment of ransomware-style encryption and wipers (including BiBi Wiper), curated hack-and-leak operations, and a March 2026 campaign that abused Microsoft Intune to exfiltrate ~50 TB and remotely wipe 80,000–200,000 devices across multiple countries, indicating high sophistication and state-directed operational control.