Iranian-linked hacker site reappears after US seizure, shows resilience of cyber operations

Handala Hack Team, part of the psychological operations under the Iranian Ministry of Intelligence. (photo: x @TInreims ·)

JAKARTA - A group of hackers suspected of being linked to the Iranian government have reactivated their site just a day after their domain was seized by US authorities. This highlights the high resilience of state-backed cyber operations.

The US Department of Justice previously seized four domains associated with the "Handala Hack Team", a public identity said to be part of a psychological operation under the Iranian Ministry of Intelligence.

The seizure was carried out with the support of the Federal Bureau of Investigation in response to the group's alleged involvement in a cyber attack on a US medical technology company.

However, it didn't take long for the site to come back online. In its statement, the Handala group called the seizure "a desperate attempt by the United States and its allies to silence their voices."

This case shows a pattern that often occurs in the global cyber security landscape: action against digital infrastructure is not always able to stop the activities of threat actors.

According to analysts from security think tanks, groups associated with the Iranian Ministry of Intelligence are already accustomed to facing blockades - from closing social media accounts to seizing domains - without significant impact on their operations.

The domain seized earlier was used to claim a cyberattack on March 11, 2026 against Stryker, a multinational medical technology company based in Michigan. In a court document filed by the FBI, there is strong indication that the group was involved in a destructive malware attack on the company's systems.

Stryker in its official statement said it was restoring the system that supports customer service, ordering, and distribution. However, the company ensured that its products remained safe and were not directly affected.

The US Department of Justice confirmed that there was enough evidence to link the "Handala" operator to the cyberattack conspiracy. However, the reappearance of their site in a short time proved that law enforcement efforts in the digital space face major challenges, especially when dealing with actors with state support.

This development once again confirms that cyber conflicts are now an integral part of global geopolitical dynamics. On the one hand, countries are trying to enforce the law and protect critical infrastructure. On the other hand, hacker groups continue to adapt, move quickly, and exploit gaps in the internet ecosystem that are difficult to fully control.