Ransomware needs a way in. Stolen credentials are the cheapest one.

Who is VahidOnline? Ransomware Attack

Ransomware victimData extortion

handalaGroup

IranCountry

Mar 17, 2026Discovered

Overview

View group profile

Industry

Other

Country

Iran

Discovered

5 months ago

Attack date

Mar 17, 2026

Confidence

100%

Severity

Medium

Status

Claimed

Threat group

handala

Total victims

103

First seen

Aug 2025

Last seen

Apr 2026

Group status

active

Sophistication

Impact score

Threat level

1.9/10

Aggressiveness5/10

Lethality0/10

Criticality0.6/10

Status breakdown

Claimed

this victim

100.0%103

Targeted sectors

Education Energy & Utilities Financial Services Government & Defense Healthcare Manufacturing Other Retail & E-Commerce Technology Transportation

Victim's position within group

Industry

Other

Known target sector

Country

Iran

Not a listed target country

Other victims

View all (103)

Same group · handala

Unprecedented Exposure: Identities of 80 Senior Cyber Officers of “Iran Desk” in Unit 8200 Revealed!
Israel
Claimed
When the Zionist Army’s Chief Was Under Handala’s Watch! General Herzi Halevi Hacked
Israel
Claimed
Handala’s Statement
—
Claimed
HANDALA EMAIL ADDRESS
—
Claimed
Exposing Israel’s Drone Queen: The Fall of Colonel Haimovich
Israel
Claimed
Raz Zimmt’s Chats Leaked to the World
Israel
Claimed

Group activity

Monthly attacks · handala

103

total · avg 11.4/mo