Pro-Iran Handala group breached Israeli defence contractor PSK Wind Technologies

Iran-linked hackers claim to have breached Israeli air defence contractor PSK Wind, which develops command and control systems.

Pro-Iran Handala group announced on April 2 that it breached PSK Wind Technologies, an Israeli engineering and IT firm specializing in integrated systems for defense and critical communications, including command and control solutions.

Handala appears as a pro-Palestinian hacktivist group but is widely seen as a front for Iran-backed Void Manticore, as reported by SecurityWeek. Known for phishing, data theft, extortion, and destructive wiper attacks, they also engage in info operations and psychological warfare. Since the Iran conflict began, they’ve targeted Israeli military servers, intelligence officers, and companies, stealing or wiping data.

The Handala claims to have stolen sensitive data from PSK Wind, including documents on command and control systems, allegedly sending it to “Axis of Resistance” missile units. The Axis of Resistance is an Iran-led political and military alliance of groups opposing Israel, the US, and allies, including Hezbollah in Lebanon, Palestinian Islamic Jihad, Syrian regime forces, and Shia militias in Iraq like Kata’ib Hezbollah.

Handala issued a threat coinciding with Passover, a major Jewish holiday that commemorates the Israelites’ liberation from slavery in ancient Egypt, warning of attacks on Israeli defense and command centers.

At this time, neither PSK Wind nor the Israeli military commented, while the group released confidential files showcasing top secret communications systems, internal documents, location photos and more.

The PSK Wind attack is part of an ongoing wave of cyber attacks on Israeli military infrastructure since February 28, coinciding with missile and drone strikes by Iran and its allies. Hackers claim the firm manages Israel’s air defence command centers, critical to systems like Iron Dome.

Since the U.S.-Israeli war with Iran began in February, the Iran-linked group Handala has intensified its cyberattacks. It claimed responsibility for a destructive breach at medical tech firm Stryker that targeted its internal Microsoft environment and remotely wiped tens of thousands of employee devices without using malware. 

The group claimed it wiped more than 200,000 servers, mobile devices, and other systems, forcing the company to shut down offices across 79 countries. The hacktivists also claimed they exfiltrated about 50TB of corporate data from the company’s infrastructure.

Recently, the Iran-linked hacking group Handala claimed the hack of the FBI Director Kash Patel’s personal Gmail account and shared alleged data, including photos and files.

The FBI is offering up to $10 million for information on the Handala hackers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Handala)