Personal Accounts Under Fire: Handala Team Targets FBI Director & Stryker
Just caught the latest report on the Handala Hack Team (Iran-linked). It’s pretty wild that they managed to breach the personal email of the new FBI Director, Kash Patel, and leak the contents. On top of that, they’re hitting targets like Stryker with actual wiper attacks.
While the political angle is getting the headlines, I want to focus on the operational security gap here. The breach of a personal email account highlights the ongoing failure to segregate high-value targets' digital lives. If a threat actor pivots from a personal Gmail/Outlook account to a professional network via credential stuffing or social engineering, all our MFA on the corporate side might not help if the personal recovery channel is compromised.
Furthermore, regarding the wiper component reported on Stryker: we need to be watching for indicators of destructive behavior, distinct from ransomware. Wipers often target the MBR or specific file extensions without a ransom note. We should be hunting for suspicious process executions like wevtutil cl (clearing logs) or disk shadow deletions.
Here is a quick KQL query to hunt for potential wiper precursors—specifically processes that attempt to disable recovery or clear logs:
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "wevtutil" and ProcessCommandLine has "cl"
or ProcessCommandLine has "bcdedit" and ProcessCommandLine has "recoveryenabled no"
| summarize count(), arg_max(Timestamp, *) by DeviceName, FileName, ProcessCommandLine
Are any of you actively auditing the personal digital footprints of your C-suite or high-value personnel, or is that still considered out of bounds?
We definitely consider OSINT on execs part of the threat modeling process now. If their personal LinkedIn shows a dog's name and that dog's name is their password recovery question, that's an enterprise risk. We don't ask for their passwords, but we do run quarterly simulated phishing campaigns targeting their personal addresses to see if they bite on 'Urgent Family Matter' lures.
On the wiper side, don't forget to check for VSS shadow copy deletions. We saw a similar pattern last year where they used vssadmin delete shadows. You can catch this with Sysmon if you're monitoring for command-line arguments.
vssadmin delete shadows
It's a tough line to walk. Auditing personal accounts is a privacy nightmare, but so is having your CEO's emails leaked on a hacker site. We've moved to providing corporate-managed identity protection (like credit monitoring and dedicated password managers) for our board members as a perk/benefit. It helps us ensure they aren't reusing passwords without having to 'audit' them directly.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access