INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Iran-Linked Hackers Breach FBI Director's Personal Email, Hit Stryker

| 2026-03-28 15:40 CRITICAL MEDIUM DATA BREACH MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
Iran-linked hackers breached the personal email account of Kash Patel, director of the US Federal Bureau of Investigation (FBI), and leaked a cache of photos and documents to the internet on March 28, 2026. The Handala Hack Team, an Iran-affiliated hacktivist persona adopted by Iran's Ministry of Intelligence and Security, claimed responsibility for the breach. This attack is part of a larger retaliatory cyber offensive against Western targets following heightened geopolitical tensions between the US, Israel, and Iran. The hackers targeted Patel's emails from 2010 and 2019, which included historical information with no government secrets. The leak also includes wiper malware that deleted company data and wiped thousands of employee devices at Stryker, a medical services provider, marking the first confirmed destructive operation targeting a US Fortune 500 company.
Technical Mitigations AI-generated
• Patch Microsoft Intune to prevent exploitation of identity through phishing and administrative access. • Implement robust monitoring for suspicious login attempts against organizational VPN infrastructure linked to Handala-associated infrastructure. • Regularly update disk encryption utilities like VeraCrypt to ensure they are not being used maliciously.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
MuddyWaterMuddyWater WiperWiper
Target & Sectors
MIDDLE_EAST MIDDLE_EAST NORTH_AMERICA NORTH_AMERICA energyenergy governmentgovernment healthhealth
Incident Timeline
‎2026/03/28
Iran-linked hackers breached FBI Director Kash Patel's personal email account and leaked sensitive information, including photos and documents.
infrastructure Windows
…ors have employed social engineering tactics to engage with prospective victims on social messaging applications to deliver Windows malware capable of enabling persistent remote access using a Telegram bot by masquerading the first-stage payload as…
In the wake of the breach, both Microsoft and the Cybersecurity and Infrastructure Security Agency ( CISA ) have released guidance on hardening Windows domains and fortifying Intune to defend against similar attacks.
threat_actor MuddyWater
This includes Handala's integration of Rhadamanthys stealer into its operations and MuddyWater's use of the Tsundere botnet (aka Dindoor ) and Fakeset , the latter of which is a downloader used to deliver CastleLoader .
data_breach 851 GB
This included the names and sensitive information of about 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government, and 851 GB of confidential data from members of the Sanzer Hasidic Jewish community.
financial $10 reward
The U.S. government is also offering a $10 million reward for information on members of the group.
Tactical Metrics
Metrics
infrastructure
​Windows
Affected Product
…ors have employed social engineering tactics to engage with prospective victims on social messaging applications to deliver Windows malware capable of enabling persistent remote access using a Telegram bot by masquerading the first-stage payload as…
In the wake of the breach, both Microsoft and the Cybersecurity and Infrastructure Security Agency ( CISA ) have released guidance on hardening Windows domains and fortifying Intune to defend against similar attacks.
Metrics
data_breach
851
Gb
This included the names and sensitive information of about 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government, and 851 GB of confidential data from members of the Sanzer Hasidic Jewish community.
Metrics
financial
10,000,000
Reward
The U.S. government is also offering a $10 million reward for information on members of the group.
Intelligence Sources
The Hacker News 2026-03-28