The Department of Justice announced that it seized four web domains tied to Iran’s Ministry of Intelligence and Security, part of a coordinated cyber campaign that included death threats, targeted doxxing, and a $250,000 bounty for the beheading of two individuals inside the United States.
The four domains, Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to, served as the digital backbone of what officials called “faketivist” groups operating as direct fronts for the Iranian government.
“Terrorist propaganda online can incite real-world violence,” Attorney General Pamela Bondi said in a statement Thursday. “This network of Iranian-backed sites will no longer broadcast anti-American hate.”
The FBI’s Baltimore Field Office led the investigation, which outlined what authorities described as a coordinated Iranian cyber warfare “playbook.” According to court documents, the network was used to leak stolen data, dox dissidents, and incite violence against American citizens, journalists, and Israeli military officials.
Investigators linked the “Handala Hack” persona to a malware attack targeting a U.S.-based medical technology firm earlier this month. The same network published the private home addresses and personal information of nearly 190 individuals associated with the Israel Defense Forces, with accompanying warnings that their homes were under surveillance.
The most alarming element, officials said, was a series of emails delivering death threats directly to Iranian dissidents living in the United States and abroad. The emails claimed Tehran had partnered with the Jalisco New Generation Cartel, a violent Mexican drug organization, to carry out assassinations on American soil. One message offered a $250,000 bounty for the beheading of two named targets and warned: “Our partners in America and Canada have been given a list of our enemies.”
FBI Director Kash Patel said the operation dismantled a broader intimidation infrastructure.
“Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans,” Patel said. “We took down four of their operation’s pillars and we’re not done. This FBI will hunt down every actor behind these cowardly death threats.”
The Justice Department also noted that Justicehomeland[.]org was used to leak sensitive Albanian government documents in apparent retaliation for Albania’s support of Mojahedin-e-Khalq, an Iranian dissident group that has long operated in exile.
Assistant Attorney General for National Security John A. Eisenberg described Iran as “the leading state sponsor of terrorism worldwide” and said the department remains committed to dismantling Tehran’s cyber operations.
In connection with the seizures, the State Department’s Rewards for Justice program announced it is offering up to $10 million for information identifying foreign actors engaged in malicious cyber activity against U.S. critical infrastructure.
