Handala, Iran's MOIS-run APT, operates as a state assassination program with a cyber wing: named operators sanctioned and killed in 2026 strikes, DOJ-confirmed cartel ties, and a tactical evolution from wiper malware to credential-theft cloud destruction that bypassed every conventional defense.
Handala is an Iranian Ministry of Intelligence front masquerading as pro-Palestinian hacktivists — deploying wiper malware, hack-and-leak campaigns, and psychological warfare against Israeli officials, Western critical infrastructure, and Iranian dissidents in exile.
Getting WiFi and Bluetooth working across three architecturally distinct machines — MediaTek MT7925, Realtek RTL8821CE, and Intel 7265D — required two kernel rebuilds, firmware sourcing from three vendor trees, and careful live ISO integration. Here's exactly how it was done.
Zerodium ran an international weapons market in plain sight for a decade — paying millions for offensive exploits, selling subscriptions to governments, and surviving untouched. The most interesting thing about it was never what it sold. It was who let it.