Handala claim to have hacked and wiped 74 servers at AGAS - https://www.agas.co.il - an Israeli MSP, MSSP and cloud reseller.

I’m not sure the size of the org stacks up with Handala’s claim. Also, 74 servers is not a lot.

I’ve reached out to AGAS to see if they want to comment.

#threatintel #handala

Handala claim to have released 10gb of customer data for AGAS.

It does appear AGAS has a security incident going on. AGAS declined to comment when asked.

#threatintel #handala

Handala say have hacked and dumped IM Cannabis aka IMC - https://imcannabis.com/ - using their access via AGAS, their MSP.

They also implicate another company, NDN Security - https://www.ndn-security.com/

#threatintel #handala

Handala claims to have done a leak and wipe of Elad municipality.

Elad's website is offline, and there's an Israeli media report of some kind of cyber incident.

Handala typically over exaggerate data volumes exfiltrated.

#Handala #threatintel

Handala have posted photos and internal diagrams of, they claim, Shimon Peres Negev Nuclear Research Center.

The data appears to have come from Soreq. I have confirmed Soreq was owned, via the IAEA.

#Handala #threatintel

A few things have happened with Handala over the past few days which I haven’t covered - they’ve been dumping cloud backup photos and making threats, including about family members. I didn’t want to cover it.

All but one of the Handala Telegram channels has been shut down tonight.

#Handala #threatintel

Handala continues to be crazy town, with data dumps of what is allegedly to be SSV Network, a blockchain company.

Handala claim they can link it (SSV Network) to Unit 8200, the Israeli intelligence agency. So far this appears to be without proof.

I’m going to guess, based on this post, they plan to post more tomorrow about Unit 8200.

#Handala #threatintel

So with the Unit 8200 stuff and Handala, their latest claim is they gained access to Silicom Limited (an IT services and networking company) and exfiltrated data, and that Silicom is a front company for Unit 8200.

Presented evidence includes a video accessing an internal VMware vCentre cluster with about 50tb of storage.

#Handala #threatintel