Iran's Hackers Are Sending Death Threats to Americans

Iran's Ministry of Intelligence is running a cyberwar on American soil that goes beyond hacking — the Handala group wiped 200,000 devices at medical giant Stryker, sent death threats with home addresses to Iranian-Americans, and doxed 190 Israeli soldiers. The FBI seized four domains on March 20. The Albis Perception Gap Index scored this story 4.0, with only US outlets covering it — 94% of the world saw nothing.

An Iranian-American influencer opened their email on a March morning and found a message from Iran's intelligence service. It wasn't spam. It contained their home address, a claim that "physical operatives" were nearby, and a direct threat to their life.

This wasn't a movie plot. It came from Handala, a hacking persona run by Iran's Ministry of Intelligence and Security (MOIS), according to the US Department of Justice. And it was part of a campaign that has crossed from cyberspace into people's living rooms.

Not Just Hacking — Hunting

On March 11, Handala claimed responsibility for a wiper attack against Stryker, a $20 billion medical technology company based in Michigan. The group said it erased data from more than 200,000 systems, servers, and mobile devices across Stryker's offices in 79 countries. The company confirmed operational disruptions and restricted access to internal systems.

Handala called it retaliation for a US strike that killed more than 170 people, most of them schoolgirls. But the Stryker hit was just the beginning:

• On March 6, Handala posted names and locations of Israeli soldiers, urging followers to "respond to these Zionist pigs yourselves."
• On March 9, they published personal data of 190 individuals linked to the IDF, with warnings that their homes were known and "consequences would soon follow."
• They stole 851 gigabytes of data from a Hasidic Jewish community in New York.
• They emailed death threats to Iranian dissidents and journalists, including at least one person living in the United States.

Palo Alto Networks' Unit 42 confirmed that Handala sent Iranian-American and Iranian-Canadian influencers direct death threats containing their home addresses, claiming operatives were already in position.

The FBI Hit Back — Then Handala Moved

On March 20, the DOJ seized four domains: handala-hack.to, handala-redwanted.to, justicehomeland.org, and karmabelow80.org. The FBI traced all four to Iranian IP ranges and a shared operational playbook combining destructive cyberattacks with "faketivist" psychological operations.

Handala's response came within hours. They set up a new website and posted: "The US Department of Justice believes they can extinguish the flame of truth."

Iran's internet has been running at 1-4% capacity since the war began on February 28. Unit 42 assessed that this should degrade state-level cyber coordination. Instead, Handala appears to operate through geographically dispersed cells acting with tactical autonomy — not waiting for orders from Tehran.

What Nobody Else Reported

Here's the part that should bother everyone: this story exists almost exclusively in American media. CBS, Axios, Krebs on Security, the DOJ itself — all US sources. No major European outlet led with it. Arabic media covered the Stryker attack through a different lens entirely — Al Jazeera framed it as retaliation, not aggression. South Asian, Latin American, and African media didn't cover it at all.

That means 5.87 billion people — 94% of the world — don't know that a state intelligence service is sending death threats with home addresses to civilians living in America and Canada.

This isn't a cybersecurity story. It's about whether a government at war can reach through a screen and put your family at risk. The answer, as of March 2026, is yes.