Iran’s MOIS Tied to Coordinated Cyber Campaign Using Multiple Hacker Personas

This report links three branded personas (Homeland Justice, Karma/KarmaBelow80, Handala) to Iran’s MOIS and describes a unified, state‑directed hack‑and‑leak influence campaign that conducts long‑term intrusions, credential theft, data exfiltration, destructive wiping/encryption (including BiBi Wiper and ransomware‑style actions), and abuse of legitimate cloud/admin tools (notably a reported Intune remote‑wipe affecting up to 200,000 devices); the ecosystem uses recurring leak sites and Telegram to publish stolen data and conduct psychological operations, and U.S. authorities have seized related domains and issued defensive guidance.