Iran-Linked Hackers Target Patel, US Officials In Escalating Cyber Threat

Iran-linked hackers are escalating their tactics by targeting government officials and employees at major companies, raising concerns about psychological warfare. The shift marks a move from corporate network breaches to direct intimidation of individuals

Iran linked hackers are escalating their tactics by targeting government officials and employees at major

Iran-linked hackers are escalating their tactics by targeting government officials and employees at major companies, raising concerns about psychological warfare. The shift marks a move from corporate network breaches to direct intimidation of individuals.

The group known as Handala Hack Team, which has been linked to Iran’s intelligence services, claimed responsibility for leaking emails tied to FBI Director Kash Patel. The data, which dates from 2010 to 2019, includes travel receipts, personal photos and other non-classified material, Axios reported.

The Federal Bureau of Investigation confirmed that Patel’s personal Gmail account had been compromised. The agency said the material accessed was historical and did not involve government information.

In a statement, the FBI said a $10 million reward is being offered for information leading to the identification of the group. Officials linked the operation to Iran’s Ministry of Intelligence and Security.

Handala also claimed it obtained data tied to employees of Lockheed Martin and contacted individuals with personal details about their families and locations. Those claims remain unverified, and a company spokesperson said it remains confident in its data security systems.

Cybersecurity researchers said targeting individuals rather than networks represents a more aggressive approach. The tactic is designed to create fear, disrupt operations and force organizations to divert resources.

“Part of it has to be that it’s consuming resources,” Jake Williams, a former NSA hacker, said. “A month from now, I can leak exactly the same emails, claim they’re brand new and consume hundreds of person hours.”

Experts said even low value or recycled data can trigger costly investigations and responses

Experts said even low-value or recycled data can trigger costly investigations and responses. They warned that such campaigns do not require new breaches to remain effective.

Researchers with the Sophos Counter Threat Unit said Handala has increased activity in recent weeks. They said the group has encouraged pro-Iran hackers to carry out additional cyberattacks.

Michael Bell, CEO of Suzu Labs, said the attack on Patel’s account appeared to be retaliation following U.S. actions targeting the group’s infrastructure. He said the breach likely exploited previously exposed credentials rather than a sophisticated intrusion.

“That’s not a sophisticated attack,” Bell said. “That’s an OPSEC failure.”

The Department of Justice said it recently seized domains linked to Handala as part of efforts to disrupt hacking operations tied to Iran. Officials said the group has also claimed responsibility for a cyberattack targeting medical technology company Stryker.

Security experts warned that personal accounts used by high-profile officials can become key vulnerabilities during conflicts. They said leaders must adopt stronger protections beyond basic multi-factor authentication.

“Personal accounts are not personal during conflict,” Ross Filipek, a chief information security officer, said. “They are part of the attack surface.”

Officials said the investigation remains ongoing

Authorities said anyone with information about the breach is encouraged to contact the U.S. Rewards for Justice program. Officials said the investigation remains ongoing.

The Handala Hack Team, put up a few pictures on their website of Patel standing next to cars with Cuban license plates and smoking cigars.

The group also posted what they said was a part of an older version of his resume.

Axios reviewed many emails that Handala said were stolen and published. They only came from Patel’s personal Gmail account, not his official FBI account.

The conversations that leaked are from the early 2010s and don’t include any information about what the FBI is doing now. Some of the emails seem to have information about Patel’s trips from 2012 to 2019, such as receipts for flights, trains, and hotels.

Others are messages and pictures he sent and received from family members, talks about filing his own taxes, and information from leasing agents about different D.C. apartments that Patel wanted to rent more than ten years ago.

Handala says that the breach happened because the FBI took over a number of the hacker group’s domains last week.