Handala, Iran's MOIS-run APT, operates as a state assassination program with a cyber wing: named operators sanctioned and killed in 2026 strikes, DOJ-confirmed cartel ties, and a tactical evolution from wiper malware to credential-theft cloud destruction that bypassed every conventional defense.