Threat Intelligence Report November 4 - November 10 2025

Handala Ransomware

Handala began as a politically-motivated hacktivist collective and has evolved into a destructive wiper-capable ransomware operator since late 2023. During the Nov 1–7 window, the group emphasised public data dumps and doxxing, continuing its regular weekend disclosures and maintaining pressure on targeted organisations rather than publishing new, large-scale exploit activity.

Detailed TTPs (narrative)

1. Initial access — Targeting via spearphishing attachments and credential harvesting; in some cases, exploitation of public-facing services to drop first-stage loaders. Attachments frequently masquerade as utilities or update installers (example: F5UPDATER.exe).
2. Staging & loader behaviour — Multi-stage chain: lightweight downloader/loader → Delphi/packed second-stage → in-memory unpacking that writes and executes wiper modules. Loaders often use signed legitimate binaries as proxies to bypass naive allowlists.
3. Execution & persistence — Uses scheduled tasks and Run keys for persistence; leverages valid credentials and lateral movement tools (PsExec-like behaviour) to spread; frequently removes shadow copies, modifies BCD/boot settings and overwrites MBR/partition metadata to disable recovery.
4. Obfuscation & anti-forensics — Heavy string/base64 obfuscation, custom packing, and anti-VM/sandbox checks. Wiper components include routines to zero out key file types and to corrupt filesystem metadata.
5. Data discovery & exfiltration — Automated collection of high-value documents and database dumps. Exfiltration occurs over encrypted HTTPS to anomalous hosts and via cloud storage/Telegram endpoints; JA3/TLS fingerprinting and non-standard ports are observed.
6. Impact phase — Wipe-first actions remove backups and recovery artifacts, then selective encryption or public data dump. Public extortion/doxxing via onion sites and Telegram channels follows, pressuring victims and increasing reputational damage.
7. Post-compromise interaction — Use of Tor hidden services for victim communication and leak sites; actor maintains a cadence of disclosures to amplify impact.
    

MITRE ATT&CK Mapping

IOCs & C2 Infrastructure

File / Artifact Indicators

• F5UPDATER.exe → Loader (SHA256: fe07dca68f288a4f6d7cbd34d79bb70bc309635876298d4fde33c25277e30bd2)
• Handala.exe → Secondary Delphi loader (SHA256: 454e6d3782f23455875a5db64e1a8cd8eb743400d8c6dadb1cd8fd2ffc2f9567)
• Hatef.exe → Windows wiper (SHA256: e28085e8d64bb737721b1a1d494f177e571c47aab7c9507dba38253f6183af35)
• Hamsa.sh → Linux base64-obfuscated bash wiper (SHA256: 6f79c0e0e1aab63c3aba0b781e0e46c95b5798b2d4f7b6ecac474b5c40b840ad)
• Extensions: .NBA observed
• Ransom notes: READ_ME.txt, readme.txt, READ_ME_.TXT
   

C2 & Network Infrastructure

Active IPs/Ports:

• 185.216.70.236:8443
• 194.180.48.149:8443
• 194.180.48.18:10443
• 171.22.28.245:41337
• 194.169.175.132
• 193.42.33.29
   

Domains:

• xn--wnscp-tsa[.]net – fake WinSCP domain
• Exfil endpoints: HTTPS/Tor, Telegram bots, cloud storage (Storj/S3-like)
   

Onion Links:

• http://vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd[.]onion
• https://handala[.]to/
• http://handala-redwanted[.]to
   

• http://handala-hack[.]to
• supporthandala[.]onion – chat interface for victims
   

Crystal Eye 5.5 Mitigation

1. Email/Web Filtering: Block executable attachments, ISO files, and spoofed domains; enable content disarm.

2. EDR Correlation: Detect bcdedit, vssadmin, and PsExec execution chains; alert on AV service stops.
3. Network Controls: Block C2 IPs/domains; restrict outbound HTTPS to unknown IPs.
4. Segmentation: Limit SMB/WinRM; isolate admin workstations.
5. Backup Hardening: Enforce immutable, offline backups and periodic restore verification.
6. Response Playbook: Rapid isolate, collect volatile data, rotate credentials, and alert SOC/PR.

Ransomware Victims Worldwide

The United States continued to dominate ransomware targeting this week, accounting for 55.07% of all reported victims. This overwhelming concentration highlights the country’s persistent vulnerability due to its extensive enterprise ecosystem, critical infrastructure, and high-value digital operations.

India (5.07%) ranked second, reflecting a steady increase in attacks on the nation’s growing IT, business outsourcing, and manufacturing sectors. The United Kingdom (4.35%), France (2.9%), Germany (2.9%), and Australia (2.9%) followed, reinforcing the trend of sustained activity across major Western economies.

Mid-tier targeting included Japan (2.17%), Singapore (2.17%), and the United Arab Emirates (2.17%), demonstrating ransomware’s widening geographic footprint across both the Asia-Pacific and Middle Eastern regions.

Smaller but recurring incidents were observed in Spain, Mexico, Switzerland, Vietnam, Brazil, and Canada (each 1.45%), while isolated attacks (each 0.72%) were recorded in Sweden, Austria, China, Malaysia, Thailand, Argentina, Slovenia, Zambia, Sri Lanka, Netherlands, Egypt, Ukraine, Indonesia, Morocco, and Italy.