The Department of Justice (DOJ) has taken action against four internet domains linked to Iran’s Ministry of Intelligence and Security (MOIS) in a major crackdown on state-sponsored cyber operations and online threats.
Officials say the seizure represents a broader effort to counter Tehran’s growing use of cyberattacks and psychological operations targeting critics, journalists, and international adversaries.
The domains — Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to — were reportedly used to claim responsibility for malware attacks, post stolen information, and issue online threats.
According to investigators, the sites functioned as coordinated components of Iranian cyber campaigns, designed to intimidate individuals and disrupt communities, including Israeli civilians and dissidents abroad.
Attorney General Pam Bondi emphasized the national security stakes.
“Terrorist propaganda online can incite real-world violence,” she said. “Thanks to our National Security Division and the U.S. Attorney’s Office for the District of Maryland, this network of Iranian-backed sites will no longer broadcast anti-American hate.”
FBI Director Kash Patel framed the seizures as a direct disruption of Iranian cyber operations.
“Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans and silence dissidents,” Patel said. “We took down four of their operation’s pillars and we’re not done.”
Court filings describe the Handala-Hack domains posting personally identifiable information (PII) of roughly 190 members of the Israeli Defense Forces and government, along with threatening messages.
The postings allegedly conveyed that targets’ locations were known and urged violent retaliation.
Investigators also linked the sites to emails sending death threats to Iranian dissidents and journalists worldwide, with references to financial bounties and criminal affiliates for carrying out attacks.
The domains Justicehomeland[.]org and Karmabelow80[.]org were associated with a separate hacktivist network used by MOIS.
The Washington Examiner reported that Justicehomeland[.]org leaked sensitive Albanian government documents in 2022 after Albania supported the Iranian dissident group Mujahedeen e-Khalq (MEK), illustrating a long pattern of Iranian exploitation of online platforms to influence foreign policy and intimidate critics.
Iran has increasingly relied on a mix of state-backed cyber units and proxy actors to achieve geopolitical objectives, including targeting Western infrastructure, private companies, and critical industries.
Analysts say such operations often combine malware attacks with propaganda and threats to amplify fear and coerce action during periods of political tension, including U.S.–Iran disputes.
In a parallel initiative, the DOJ’s Rewards for Justice program is offering up to $10 million for information leading to the identification of individuals acting on behalf of foreign governments to carry out malicious cyber activities against U.S. critical infrastructure, as previously highlighted by Resist the Mainstream.
Federal authorities, including the FBI’s Baltimore Field Office and Cyber Division, are continuing investigations, underscoring that state-sponsored online threats remain a persistent risk to national and allied security.
The DOJ and its law enforcement partners say the coordinated domain seizures signal a proactive stance against cyber aggression and online intimidation campaigns.
Officials warn that while these four sites have been disabled, broader efforts will continue to identify, disrupt, and hold accountable those using cyberspace to threaten individuals and undermine democratic institutions.
