Handala Group Tied to Iranian Hack‑and‑Leak Operations, FBI Reveals

The FBI attributes a campaign by the Iran-linked Handala group targeting dissidents, journalists and opposition groups since autumn 2023. Operators used tailored social engineering and a multi-stage Windows malware that masqueraded as legitimate apps, performed reconnaissance, recorded screens/audio, compressed and exfiltrated files via Telegram C2 bots, and has been linked to destructive activity; the FBI issued mitigation guidance for individuals and organizations.