U.S. Seizes Domains of Iran-Linked Hacking Group

ArchivedConflicting Facts
  • March 20, 2026 at 6:49 PM ET
  • Est. Read: 1 Min
U.S. Seizes Domains of Iran-Linked Hacking GroupAI-generated illustration — does not depict real events
Listen to This SummaryAI-generated audio

Key Takeaways

The U.S. seized domains associated with Handala, an Iran-linked hacking group responsible for cyberattacks on American companies. The group quickly restored its website after the takedowns.

  • FBI seizes four domains linked to Handala
  • Group claims responsibility for March 11 attack on Stryker
  • DOJ accuses Handala of transnational repression and psychological operations
  • Experts warn of ongoing cyber threats from Iran-linked groups

The U.S. Department of Justice (DOJ) seized four domains linked to Handala, an Iranian government-backed hacking group, following a March 11 cyberattack on Michigan-based medical device maker Stryker. The FBI took down websites used by Handala to claim responsibility for the attack and share sensitive information about Israeli military personnel.

The DOJ described Handala as part of Iran's Ministry of Intelligence and Security (MOIS), engaging in 'hacking and transnational repression schemes.' According to Reuters, the group quickly restored its website, highlighting the resilience of Iranian-linked hackers. The FBI affidavit supporting the seizure asserted probable cause that Handala operators conspired to carry out a destructive malware attack against Stryker.

The cyberattack on Stryker caused global disruption but did not affect its medical products or implants. CBS News reported that Handala also used seized websites to threaten dissidents and share personal information of Israeli government employees, alleging ties with the Mexican cartel Jalisco New Generation for targeted assassinations. The DOJ's actions come amid fears of escalating cyber warfare between the U.S., Israel, and Iran.

Experts warn that these takedowns will not significantly slow down Handala or similar groups. Ari Ben Am, an adjunct fellow at the Foundation for Defense of Democracies Center on Cyber and Technology Innovation, noted that Iranian hackers are accustomed to such actions and can quickly relocate their operations. The incident underscores ongoing cyber threats from Iran-linked groups targeting U.S. companies.

How this summary was created

This summary synthesizes reporting from 3 independent publishers using AI. All sources are cited and linked below. NewsBalance is a news aggregator and media literacy tool, not a news publisher. AI-generated content may contain errors or inaccuracies — always verify important information with the original sources.

Read our full methodology →

Read the original reporting ↓