Iran-Linked Group Handala Claims to Have Breached Three Major UAE Organizations

Key Takeaways

• Handala claims to destroy 6 PB data, steal 149 TB from UAE agencies
• Targets include Dubai Courts, Land Department, Roads & Transport Authority
• Group linked to Iran-backed Void Manticore, active since Iran‑Israel conflict
• Prior attacks hit Stryker, PSK Wind, FBI director’s Gmail
• FBI offers $10 million reward for information on Handala

Pulse Analysis

The cyber‑threat landscape in the Middle East has been reshaped by the emergence of Handala, a hacktivist outfit widely believed to operate as a front for Iran‑backed Void Manticore. Since the escalation of the Iran‑Israel conflict, the group has shifted from traditional espionage to high‑impact wiper attacks that combine data destruction with large‑scale exfiltration. Recent operations against Israeli defense contractor PSK Wind Technologies and medical‑device giant Stryker demonstrated a capability to infiltrate corporate Microsoft environments and wipe tens of thousands of endpoints without leaving conventional malware signatures. This evolution signals a more aggressive posture aimed at both strategic disruption and psychological warfare.

In early April, Handala announced a breach of three cornerstone UAE entities: the Dubai Courts Department, the Dubai Land Department, and the Dubai Roads & Transport Authority. The claim includes the destruction of six petabytes of data and the theft of 149 terabytes of sensitive information—a volume that could cripple record‑keeping, property transactions, and transportation logistics across the emirate. While independent verification remains pending, the sheer scale of the alleged loss underscores the vulnerability of government digital assets that rely on centralized data stores and legacy security controls. Any disruption could ripple through the region’s real‑estate market and public‑service delivery.

The incident arrives as the FBI has placed a $10 million bounty on Handala operatives, highlighting the group’s growing relevance to U.S. national security. For multinational firms and public agencies, the breach serves as a stark reminder to adopt zero‑trust architectures, segment critical networks, and conduct regular red‑team exercises that simulate destructive wiper scenarios. Moreover, the geopolitical dimension—where state‑aligned hacktivists weaponize data as leverage—pressures policymakers to coordinate cyber‑defense strategies across borders. Strengthening threat‑intelligence sharing and investing in rapid‑response capabilities will be essential to mitigate future attacks of this magnitude.