U.S. Seizes Iranian Domains Following Cyberattacks and Disinformation

The United States Department of Justice seized four internet domains—Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to—operated by Iran's Ministry of Intelligence and Security. Federal officials stated these sites were used to conduct psychological operations, spread terrorist propaganda, and target adversaries through the leaking of sensitive data, including information on 190 Israeli government associates and 851 gigabytes of data from the Sanzer Hasidic Jewish community.

Investigations by the FBI revealed the domains were used to send death threats to Iranian dissidents and journalists, with some messages soliciting Mexican cartels to commit violence. These actions coincided with a coordinated Iranian offensive against Israel that combined missile strikes with a disinformation campaign, including false claims that Prime Minister Benjamin Netanyahu had been killed. Simultaneously, the Iranian-linked hacking group Handala attacked Stryker, a Michigan-based medical technology company, claiming the move was retaliation for a U.S.-linked bombing of a girls' school in Iran.

U.S. officials characterized the seizures as a direct effort to disrupt Tehran's ability to terrorize individuals and infiltrate computer systems during an active conflict. Senator Tom Cotton warned that the threat extends beyond cyberspace, noting that Iran has attempted to recruit Americans to commit acts of terror. The crackdown follows a period of heightened tensions including strikes that killed Iranian Supreme Leader Ayatollah Ali Khamenei.