Handala Claims Breaches at Major UAE Organizations

Handala Claims Breaches at Major UAE Organizations

The Iran-linked threat actor Handala is claiming responsibility for breaches against three significant organizations in the United Arab Emirates: Dubai Courts, Dubai Land Department, and Dubai Roads & Transport Authority. According to Cyber Threat Intelligence, Handala has publicly asserted these intrusions, though independent verification of the claims and the extent of any data compromise is still pending.

This isn’t an isolated incident. Cyber Threat Intelligence’s reporting highlights a broader landscape of cyber activity, including a CPUID watering hole attack spreading STX RAT malware, and Adobe patching an actively exploited Acrobat Reader flaw (CVE-2026-34621). While these other incidents aren’t directly linked to Handala, they underscore the persistent and varied threats organizations face daily. The focus on critical infrastructure and government entities, as seen with the alleged UAE breaches and even claims of controlling Venice’s San Marco anti-flood pumps by other hackers, clearly signals a continued high-stakes environment.

What This Means For You

  • If your organization operates in the UAE or has ties to these specific entities, it's time to double down on your threat hunting. Review access logs, monitor for unusual activity, and ensure all public-facing assets are patched and hardened. These aren't just claims; they're a wake-up call to validate your defensive posture against state-sponsored or state-aligned threats.

🛡️ Detection Rules

2 rules · 5 SIEM formats

2 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, and QRadar AQL.

high data-breach event-type

Monitor Authentication from Breached Vendor — Dubai Courts

Sigma Splunk SPL Sentinel KQL Elastic QRadar AQL

Get this rule in your SIEM's native format — copy, paste, detect. No manual conversion.

2 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.

Get Detection Rules →

Related Posts

JanaWare Ransomware: Turkish Citizens in the Crosshairs

The cybercriminal landscape is a constantly shifting beast, and new ransomware strains are always emerging. According to The Record by Recorded Future, a new player...

threat-inteldata-breachgovernmentmalwareransomwareidentity
/MEDIUM

Microsoft Patches SharePoint Zero-Day, 160 Vulnerabilities

Microsoft's latest Patch Tuesday was a big one, addressing a staggering 161 vulnerabilities. According to SecurityWeek, this makes it the second-largest Patch Tuesday ever, based...

threat-intelvulnerabilitymicrosoft
/MEDIUM

Microsoft Drops Windows 10 Extended Security Update

Microsoft has rolled out the Windows 10 KB5082200 extended security update, a critical patch addressing vulnerabilities initially slated for the April 2026 Patch Tuesday. According...

threat-inteldata-breachmalwarevulnerabilitymicrosofttools
/HIGH