Handala claims access to Iran International WhatsApp and internal network

• Ransomware group: Handala
• Country: United Kingdom
• Sector: Technology
• Announcement date: July 9, 2025

Handala claims long-term access to Iran International networks

The threat actor known as Handala has published an announcement on a leak site claiming to have obtained access to the internal networks and communication channels of Iran International. According to the claim made on July 9, 2025, the group alleges that they have maintained access to the organization's networks for a period of approximately 31 months.

The group asserts that this prolonged access has allowed them to intercept various forms of sensitive information. Specifically, the threat actor claims to have intercepted messages, calls, and files from prominent communication platforms used by the organization, such as WhatsApp and Signal. To support these claims, the group has shared a proof-of-concept file that displays a video editing software interface, which they suggest is evidence of their presence within the organization's systems.

Alleged data types and contents of the leak

The information allegedly exfiltrated by Handala is said to include a variety of sensitive organizational data. The group claims to have obtained access to internal network files and communication logs, alongside specific data from messaging applications. The materials provided as evidence include screenshots showing visual content within a video editing software, which the group claims are related to the internal operations of the organization.

The specific items mentioned in the claim include:

• WhatsApp communications
• Signal communications
• Internal network files
• Communication logs

About Iran International

Iran International is a London-based international news channel that broadcasts in Persian. The organization produces news and analysis content focused on current events and politics in Iran.

Analysis and potential implications

The claims made by Handala suggest that the organization's internal communication security may have been compromised over an extended period. Such a breach can expose employees and organizational resources to significant risks, including targeted phishing attacks or identity theft. Furthermore, the potential exfiltration of communication data may jeopardize the organization's operational privacy and its strategic plans.

Given the group's alleged ties to Iran and its history of targeting Israeli entities, this incident may represent a politically motivated cyber-espionage activity. In such scenarios, threat actors often use double extortion tactics, where they not only encrypt systems but also threaten to leak sensitive data to pressure the victim. While the specific details of a ransom demand were not provided in the announcement, the nature of the claims points toward a significant breach of privacy.

For organizations operating in the media and technology sectors, this incident highlights the importance of robust data security protocols. To mitigate the risks associated with long-term unauthorized access, organizations typically need to conduct thorough reviews of their security frameworks. This includes evaluating legal requirements regarding potential data breach notifications and implementing rigorous monitoring to detect unauthorized access to communication platforms and internal networks. Protecting against such sophisticated threats requires continuous vigilance and the implementation of defense-in-depth strategies to secure both internal files and external communication channels.