Handala’s Digital Battlefield: Uncovering the Infrastructure of an Anti-Israel Hacktivist Campaign

In recent years, geopolitical tensions have increasingly spilled into cyberspace, giving rise to a wave of hacktivist groups that frame cyberattacks as acts of political resistance. Among these actors, Handala has emerged as a particularly visible presence within the pro-Palestinian cyber ecosystem. Named after the iconic Palestinian cartoon character created by Naji al-Ali, the group draws heavily on the symbolism associated with the figure: a barefoot child who stands with his back turned, representing resistance, displacement, and a refusal to accept injustice. By adopting this name and imagery, the group positions its cyber activities as part of a broader ideological struggle rather than purely criminal operations.

Handala began appearing in online spaces around late 2023, as the Israel–Hamas conflict intensified and hacktivist activity surged across multiple regions. Like many politically motivated cyber groups, its messaging blends propaganda, political statements, and claims of cyber intrusions. Over time, the group has targeted a range of Israeli institutions and organizations, frequently publishing announcements or alleged data leaks across forums, messaging platforms, and dedicated leak sites. These activities have gradually drawn attention within both cybersecurity circles and online hacktivist communities.

Despite its growing visibility, much about Handala remains unclear. The group operates under shifting online identities, frequently moving between platforms and channels while maintaining a steady stream of announcements and leak claims. This fluid online presence makes it difficult to understand how the group organizes itself, where it communicates, and how its operations are distributed across the internet.

This investigation began with a simple question: how does Handala sustain its cyber campaign online? By tracing the group’s digital footprint across forums, messaging platforms, and dark web infrastructure, the analysis gradually reveals a broader network of channels, domains, and communication pathways that support its activities. What initially appeared to be isolated leak posts ultimately points to a far more interconnected ecosystem operating behind the scenes.

Incident Trigger and Initial Investigation

The investigation began with a keyword search for “Handala” within StealthMole’s Government Monitoring tool. This initial query surfaced several posts linked to the group that referenced alleged cyberattacks targeting Israeli government entities. Among the indexed results were three incidents published on BreachForums between 2024 and 2026, indicating that the group had previously used underground forums to publicize its activities.

One of these threads, titled “Israel Police Hacked,” was particularly notable. Although it appeared in StealthMole monitoring results during 2026, the original forum post dated back to 9 February 2025, suggesting that the content had resurfaced through reposting or renewed attention within underground communities.

To determine whether these forum posts represented isolated claims or part of a broader pattern of activity, the investigation expanded to StealthMole’s Leaked Monitoring tool. This search revealed a much larger dataset associated with the group, identifying 176 potential victims linked to Handala-related leak announcements.

The results also showed a clear shift in how the group published its disclosures. Earlier posts were distributed primarily through underground forums and Telegram channels, but more recent entries pointed to a dedicated leak platform operated by the group itself.

Two key communication channels repeatedly appeared in connection with these announcements:

• https://t.me/s/Handala_hack
• https://t.me/Handala_Backup

Among the leaked monitoring results, the most recent entry stood out as a significant development. Unlike earlier disclosures that relied on forums or messaging platforms, this post was hosted directly on the group’s own website.

• https://handala******.**/un********/

The page carried the title “Unprecedented Disclosure of 50 Senior Israeli Air Force Officers’ Information” and presented the announcement as a major data exposure linked to Israeli military personnel. Because this disclosure represented the latest activity attributed to the group and was hosted on infrastructure directly controlled by the actors, it became the primary focal point for further analysis.

With the source of the announcement identified, the investigation pivoted to the domain hosting the leak. By running the domain through additional StealthMole tools, including Dark Web Tracker and Telegram Tracker, the analysis began mapping the broader ecosystem connected to the group. What initially appeared to be a single leak announcement soon expanded into a much larger network of domains, messaging channels, and communication platforms supporting Handala’s online operations.

Expanding the Investigation: Mapping Handala’s Online Infrastructure

With the leak page identified, the investigation shifted toward understanding the infrastructure supporting Handala’s operations. The domain hosting the disclosure was used as the first pivot point, allowing StealthMole tools to identify additional communication channels and online platforms connected to the group.

The domain handala*******.**, which hosted the March 2026 disclosure, appeared to function as a central hub for the group’s announcements and leak posts.

• https://handala**********.**

Running this domain through StealthMole’s Dark Web Tracker revealed multiple associated communication channels and identifiers linked to the group’s online presence.

One of the most significant findings was a network of Telegram channels connected to the Handala ecosystem. These channels appear to serve different roles, including announcements, backup communication channels, and distribution of leak-related content.

Telegram Channels Identified

• https://t.me/Handala_Leak
• https://t.me/handala_hack3
• https://t.me/handala_hack6
• https://t.me/Handala_backup
• https://t.me/handala_hack20
• https://t.me/handala_channel
• https://t.me/Handala_hack
• https://t.me/handala_rss
• https://t.me/HANDALA*****

The presence of numerous channels suggests that the group relies heavily on Telegram as its primary communication platform. Hacktivist groups frequently maintain multiple channels to ensure continuity of operations, especially when primary accounts are suspended or removed by platform moderators.

In addition to Telegram channels, StealthMole also identified a Session messenger ID, indicating that the group provides alternative encrypted communication methods.

Session ID

• 05402*************************************************c929

The discovery of this identifier suggests that the operators offer additional channels for private communication beyond public messaging platforms. Privacy-focused messaging services such as Session are often used by online communities seeking to maintain anonymity while coordinating activities or communicating with external contacts.

Together, these findings indicate that the leak website is only one component of a larger communication ecosystem. The group appears to rely on a distributed network of platforms, ranging from public messaging channels to encrypted communication identifiers, to promote its announcements and maintain contact with followers.

Telegram Activity and Platform Migration

Further analysis of the identified Telegram channels provided additional insight into how Handala manages its online presence and adapts to platform restrictions. Several messages within the channels referenced the suspension of social media accounts associated with the group, indicating repeated moderation actions against its online profiles.

For example, activity observed within the channel HANDALA_HPR2 referenced a Twitter account linked to the group:

• https://x.com/HPRSEC

At the time of investigation, this account had been suspended on 9 March 2026, illustrating the ongoing disruption faced by the group on mainstream social media platforms.

Additional evidence of these disruptions appeared within another Telegram channel:

Telegram Channel

• https://t.me/handala_rss

Messages in this channel reported that another account associated with the group had also been suspended earlier that week.

Suspended Account

• https://x.com/HANDALA_FRONT

The suspension was reported on 6 March 2026, suggesting that multiple Handala-affiliated social media profiles had been removed in a short period of time. Earlier investigations had also identified the following account linked to the group’s activities:

Previously Identified Account

• https://twitter.com/handala_hack

The repeated suspension of these accounts appears to have contributed to the group’s increasing reliance on Telegram as its primary platform for announcements and communication.

Further examination of the group’s backup Telegram channel also revealed a series of invite links pointing to additional private or temporary groups that had been used at various points over the past year.

Telegram Invite Links Identified

• https://t.me/+gy8TRxf4pVljMzI0 (February 2025)
• https://t.me/+cFjcge2T7Y85NTg0 (February 2025)
• https://t.me/+drbzBna3Bis1ZTM0 (January 2025)
• https://t.me/+qhaXhUkMG1NiNjZl (December 2024)

These invite links suggest that the group periodically creates new channels or private groups, possibly in response to account suspensions or to maintain restricted communication spaces for specific audiences.

Overall, the findings highlight a pattern of platform migration, where Handala shifts its communication channels whenever accounts are suspended or restricted. Telegram appears to function as the central hub of this ecosystem, while other platforms are used intermittently for broader outreach before eventually being abandoned or removed.

Dark Web and Supporting Infrastructure

As the investigation continued, further analysis of the Telegram channels uncovered additional infrastructure associated with Handala’s operations. One of the most notable discoveries emerged from the Telegram channel:

Telegram Channel

• https://t.me/handala_channel

Messages within this channel referenced an onion service associated with the group, indicating the presence of infrastructure hosted within the Tor network.

Onion Website

• http://vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd.onion/

Running this address through StealthMole’s Dark Web Tracker revealed that the site appeared to function as another platform for publishing breach claims and distributing supporting materials. The page identified during the investigation included a post titled “Amos Spacecom Hacked,” which referenced an alleged compromise related to satellite communications infrastructure.

The page also contained links to files labeled as proof-of-concept (PoC) materials, suggesting that the group uses the onion site to distribute sample data or supporting evidence intended to validate its claims.

Further analysis of the onion infrastructure revealed additional resources connected to the group’s activity.

Additional Telegram Channel

• https://t.me/handala_poc

This channel appears to be associated with the distribution of proof-of-concept material or leaked data samples related to the group’s announcements.

In addition to messaging channels, the investigation also identified the use of external file-hosting platforms for distributing files linked to the group’s disclosures.

File Hosting Link

• https://mega.nz/file/25wmUD****************************fM

The presence of a Mega file link suggests that the group may use cloud-based storage services to distribute data samples or archive materials related to its leak announcements.

Another domain connected to the group’s ecosystem was also identified during the investigation.

Additional Surface Domain

• http://handala*******.***/

Although the exact function of this website could not be fully verified during the investigation, its appearance alongside other Handala-linked infrastructure suggests that it may serve as an additional platform for hosting announcements, propaganda, or related content.

These findings indicate that Handala’s online presence extends beyond messaging platforms and forums. Instead, the group appears to operate a layered infrastructure that includes surface web domains, Tor-hosted services, and external file-hosting platforms. This distributed approach allows the group to maintain the availability of its content even when individual platforms or accounts are suspended.

Conclusion

The investigation reveals that Handala’s activities are supported by a layered online ecosystem rather than a single platform or communication channel. Instead of relying on one outlet to publicize its operations, the group distributes its presence across multiple services, combining messaging platforms, dedicated leak websites, dark web infrastructure, and external file hosting services.

Among these platforms, Telegram appears to function as the central hub of the group’s communication network. The numerous channels identified during the investigation serve different roles, including public announcements, backup communication spaces, and distribution points for leak-related content. The existence of several backup channels and invite-only groups also indicates that the group anticipates disruptions and maintains alternative channels to ensure continuity of communication.

At the same time, Handala appears to rely on its own websites and Tor-hosted infrastructure to publish leak announcements. Hosting disclosures on actor-controlled platforms allows the group to retain control over its messaging while reducing dependence on third-party forums or social media services that may remove or restrict its content.

External file hosting platforms, such as Mega, appear to complement this infrastructure by enabling the distribution of sample datasets or supporting materials linked to leak claims. Separating file hosting from the main disclosure pages allows the group to share larger files while maintaining a lightweight publication platform for announcements.

Another notable pattern is the group’s repeated movement between platforms. Several social media accounts associated with Handala were found to have been suspended, indicating ongoing moderation actions on mainstream platforms. In response, the group’s communication appears to have shifted increasingly toward Telegram channels and dedicated websites, where the operators have greater control over their presence.

These findings suggest that Handala operates through a distributed digital ecosystem designed to maintain visibility and resilience. By spreading its activities across multiple platforms and infrastructure layers, the group is able to continue publishing announcements and promoting its campaigns even when individual accounts or channels are disrupted or removed.

Editorial Note

Investigations into cyber and dark web activities rarely produce absolute certainty. Hacktivist groups frequently operate under pseudonyms, rotate communication channels, and shift infrastructure over time, making definitive attribution and operational assessment inherently challenging. This case illustrates how StealthMole’s monitoring capabilities can help analysts navigate that uncertainty by tracing connections across forums, messaging platforms, and hidden services, gradually revealing the broader ecosystem that supports such operations.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

Behind the Mask: Mapping the ‘Anonymous Hackers’ Hack-for-Hire Infrastructure

Services offering hacking capabilities for hire are not new to the dark web. Over the years, numerous hidden services have emerged claiming to provide everything from website intrusions and social media account takeovers to DDoS attacks and data extraction. These platforms often present themselves as professional teams of hackers, advertising a wide range of services while encouraging potential clients to communicate through encrypted channels.

At first glance, many of these sites appear to operate independently. They carry different names, use different domains, and present themselves as separate groups. However, the line between independent actors and shared infrastructure is often difficult to see. Operators frequently rotate domains, change branding, and introduce new contact channels, making it harder to determine whether these services truly belong to different groups or are simply different faces of the same operation.

Using StealthMole, this investigation explored several Tor-based websites advertising hacking services. As the analysis progressed, a series of unexpected connections began to surface: linking domains, contact information, and cryptographic identifiers across multiple sites that initially appeared unrelated.

What began as a routine review of a single service eventually led to a broader investigation into a network of hacking-for-hire platforms operating across several Tor domains.

Incident Trigger and Initial Investigation

The investigation did not initially begin with hack-for-hire services. Instead, the discovery emerged while analyzing infrastructure connected to a separate Android malware case. During that analysis, StealthMole surfaced a Tor hidden service advertising professional hacking services under the name “Anonymous Hackers.”

• hackd******************************************qyd.onion

The platform presented itself as a professional hacking service provider, offering a wide range of capabilities including website intrusions, DDoS attacks, social media account compromise, database leaks, email hacking, phone monitoring, and even services such as background checks and cryptocurrency recovery. The interface also provided several communication channels intended for potential clients, including encrypted messaging and email contact options.

Initial examination of the site revealed multiple contact identifiers embedded within the platform. These included the following email addresses:

• sha****t@tutamail.com
• 3*********@anmail.org
• ano******ers@tuta.com
• sh********c@proton.me

The website also displayed a public PGP fingerprint intended for encrypted communication with customers:

• 25AD**********************************E0

Given that dark web service providers often reuse contact information or cryptographic identifiers across multiple platforms, these artifacts provided an opportunity to pivot further using StealthMole. By investigating these identifiers, additional hidden services, contact channels, and infrastructure elements associated with the same ecosystem began to emerge.

Expanding the Infrastructure

With the initial artifacts identified, the investigation shifted toward determining whether the “Anonymous Hackers”website operated as an isolated service or if it was part of a larger infrastructure. Using StealthMole’s dark web monitoring tools, the investigation began by pivoting on the contact identifiers discovered on the site, particularly the email addresses and the PGP fingerprint.

One of the earliest pivots focused on the email address 3389@anmail.org, which led to the discovery of several additional Tor hidden services. These domains shared similar naming structures and page titles, suggesting that they advertised the same type of hacking services. The domains identified through this pivot included:

• hackdbwjdfrdty6wo5uuthaqbw4i6polnoithj4nup7ulqv6ikkdssqd.onion
• 22222222yttarxo4r6kxpqfduphh2bjy24xflod4ikft7l62dcxm5nqd.onion
• latest2fombxgqmvju47iexyqql4wnnrakwqi4n4bi3gksyjk7afuvqd.onion

Further examination of the same pivot also surfaced another PGP fingerprint associated with the infrastructure:

• B9BF*********************************AD7

The appearance of additional domains and cryptographic identifiers suggested that the original site might be part of a larger group of hidden services rather than a standalone operation. Each newly discovered artifact provided another point for investigation, allowing the analysis to continue mapping the infrastructure connected to these hacking platforms.

Discovering “Shadow Hacker” Infrastructure

As the investigation continued, StealthMole pivots began revealing additional hidden services connected to the previously identified artifacts. One of the domains uncovered during this stage was:

• hackvkgcbnm5wbgadmmn4hzt5rnraaxcmuycud56uuyze5jvdrl26gad.onion

Unlike the earlier domains that used the “Anonymous Hackers” branding, this hidden service operated under the name “Shadow Hacker.” The site advertised a similar set of hacking services and followed a comparable structure, including service descriptions, pricing information, and contact channels for potential clients.

The page also exposed several additional artifacts that could be used for further investigation. These included the email address:

• co*******n@privatemx.org

as well as a Bitcoin wallet listed for payments:

• bc1*************************3e0

The wallet appeared on a service page describing customized hacking operations, where clients were instructed to contact the operators, receive a quote, and then provide a deposit before work would begin. Although the wallet did not show any confirmed transactions during the analysis, its presence indicated that the service accepted cryptocurrency payments for its operations.

In addition to the hidden service, the site also referenced a surface web domain:

• https://shadowhacker.**/

The discovery of a separate brand advertising nearly identical services raised an important question: whether “Shadow Hacker” represented a completely different group offering similar services, or whether it was connected to the same infrastructure previously observed in the “Anonymous Hackers” platform.

To answer this question, the investigation continued by pivoting on the newly discovered artifacts, including the email addresses, PGP keys, and associated domains linked to the Shadow Hacker infrastructure.

Mapping Additional Shadow Hacker Artifacts

Following the discovery of the Shadow Hacker service, the investigation shifted toward identifying additional infrastructure connected to this brand. Using StealthMole, pivots were performed on the domains, contact emails, and identifiers discovered on the Shadow Hacker pages. These searches quickly revealed that the Shadow Hacker ecosystem extended across multiple Tor hidden services.

One of the domains identified during this phase was:

• shadowmpqfj37rd3zlaakurssypadpyh52siaeqkt5vmi423xuj4xgid.onion

This hidden service hosted an “About” or introduction page that presented the individuals behind the operation. The page listed several hackers along with brief descriptions of their alleged specialties, including areas such as website exploitation, database extraction, social media account compromise, and network intrusion.

The site also exposed several additional contact channels associated with the Shadow Hacker platform. These included the following email addresses:

• shadow*****e@proton.me
• shdw*******r@proton.me
• shadow***team@proton.me

Alongside these contact details, the site referenced another PGP key used for encrypted communication:

• 242EC286F453F97C362FF1388B2F73CF1BEA8AA3

During the same stage of analysis, additional hidden services with similar naming patterns were identified. These included domains beginning with prefixes such as “shadow” or numeric strings like “222222.” Although many of these domains were inactive at the time of analysis, StealthMole’s historical data indicated that they had previously hosted pages offering the same categories of hacking services.

• shadowjjtyffuogtmpu3m3r66oiezh4ejahmyj5wojjeefn4gjqfdkqd.onion
• 2222222gdfw2ycyg5agpsnxcc6juuq5y2ozrtjnormjjbj5wy6hpsiqd.onion
• shadow45g2t4suurxnuwn2eutpfwoeq3xlvcgwnimevj2oqfonuehzqd.onion
• shadhy5mlcyyzso2cijxl5nb6kf5fxwgynoghw3waymvsuww22jqkzyd.onion

The discovery of multiple domains, rotating contact emails, and additional cryptographic identifiers suggested that the Shadow Hacker infrastructure was not limited to a single hidden service. Instead, it appeared to consist of several interconnected Tor domains that were periodically replaced or rotated while continuing to advertise similar hacking services.

Tracing Links Between Anonymous Hackers and Shadow Hacker Services

As additional Shadow Hacker domains and contact artifacts were uncovered, the investigation began to reveal clear overlaps with the infrastructure originally associated with the Anonymous Hackers platform. Several identifiers discovered during earlier pivots appeared again while exploring Shadow Hacker domains, suggesting that the two services might not be entirely separate operations.

One of the key artifacts connecting these platforms was the email address shado****t@tutamail.com, which led to another hidden service:

• anonymousvgqaxtvx5fpdiqnwhu6tyoqtejmzlloc3x7grvf2ch4lnid.onion

This domain hosted pages advertising hacking services similar to those previously observed. The site included service listings such as DDoS attacks and displayed pricing structures comparable to those used by the Anonymous Hackers platform.

Further examination of this domain revealed additional contact identifiers. Among them was the email address:

• x***8@anmail.org

The same domain also referenced another PGP fingerprint associated with encrypted communication:

• 9A64*******************************CC

Additional pivots during this stage surfaced two Shadow Hacker domains that followed similar naming patterns:

• shadow***********************************************gid.onion
• shadow************************************************ad.onion

While these sites carried Shadow Hacker branding, their layout, service descriptions, and navigation structure closely resembled the Anonymous Hackers platform. Both sets of sites promoted comparable hacking services and relied on similar communication channels, including ProtonMail addresses and PGP encryption.

These overlaps indicated that the infrastructure behind the two brands was likely interconnected. Rather than operating as entirely independent groups, the Anonymous Hackers and Shadow Hacker services appeared to share elements of their operational setup, including domains, contact channels, and cryptographic identifiers.

Operational Patterns Across the Infrastructure

As more domains, emails, and identifiers were uncovered, several consistent patterns began to emerge across the investigated platforms. Although the sites appeared under different names and domains, many of their operational characteristics remained remarkably similar.

One of the most noticeable patterns involved the structure of the Tor domains themselves. Many of the discovered domains followed recognizable prefixes such as “shadow” or strings beginning with repeated numbers like “222222.”While the remainder of each domain consisted of randomized characters typical of Tor v3 addresses, the repeated prefixes suggested that the domains were intentionally generated or selected using similar naming conventions.

Another consistent element was the use of specific email providers for communication with potential clients. Across the different sites, contact addresses frequently relied on services such as ProtonMail, Tuta Mail, and temporary or anonymous email providers like Mailxtor. These addresses were often rotated across different domains, while maintaining recognizable naming patterns such as “shadow,” “xss,” or similar identifiers.

The investigation also revealed the use of multiple PGP keys for encrypted communication. Rather than relying on a single key, the sites displayed several different PGP fingerprints across their various domains. This approach may allow operators to compartmentalize communication channels or replace identifiers if a particular site becomes inactive.

Despite the changes in domains, emails, and cryptographic identifiers, the structure of the websites themselves remained largely consistent. Pages advertising hacking services often followed the same layout, with similar navigation menus, service categories, and pricing structures. Services such as website hacking, DDoS attacks, social media account compromise, and data extraction appeared repeatedly across the different domains.

In some cases, the same service descriptions and pricing models were presented on multiple sites, even when the platforms operated under different branding such as Anonymous Hackers or Shadow Hacker. This consistency suggested that the sites may have been built using the same template or maintained within a shared operational environment.

Another notable feature observed during the investigation was the presence of session-based communication pages, where users were provided with session identifiers or encrypted messaging options to contact the operators. These communication methods appeared across several domains and were likely intended to provide private channels for negotiating services with potential clients.

Overall, these recurring patterns indicated that the various domains and platforms were not simply isolated hacking services appearing independently on the dark web. Instead, the infrastructure displayed several shared characteristics that suggested a coordinated or closely related operational structure.

Conclusion

The investigation began with the discovery of a single Tor website advertising hacking services under the name Anonymous Hackers. Through successive pivots in StealthMole, additional hidden services, contact emails, and cryptographic identifiers were uncovered, revealing a broader infrastructure operating across multiple Tor domains.

During the analysis, several platforms advertising hacking services were identified under different branding, most notably Anonymous Hackers and Shadow Hacker. Although these sites presented themselves as separate services, they displayed overlapping operational elements, including shared contact patterns, similar communication channels, and closely matching website structures.

The presence of multiple domains, rotating contact emails, and several PGP keys suggests that the operators behind these services maintain a flexible infrastructure capable of shifting domains and identifiers while continuing to advertise similar hacking services. This approach allows the platforms to maintain operational continuity even as individual domains become inactive.

Editorial Note

Investigations involving dark web infrastructure rarely provide definitive attribution, as operators frequently rotate domains, communication channels, and identifiers to obscure their activities. This case highlights how pivoting across artifacts can reveal relationships between platforms that initially appear unrelated. Tools like StealthMole play an important role in navigating these complex environments, enabling analysts to uncover patterns and connections that might otherwise remain hidden.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

From Defacements to Ransomware: Mapping Bangladesh’s Evolving Cyber Threat Landscape Through the NightSpire Case

Bangladesh’s rapidly expanding digital ecosystem has increasingly attracted the attention of cyber threat actors. As government services, financial systems, manufacturing supply chains, and educational institutions continue to digitize, the country’s attack surface has grown significantly. At the same time, uneven cybersecurity maturity across sectors has created opportunities for both opportunistic and organized threat actors to exploit vulnerabilities.

Recent monitoring of Bangladesh-linked cyber incidents reveals a diverse threat environment. Website defacements remain one of the most visible indicators of compromise, frequently targeting public-facing systems such as educational institutions, small businesses, and government portals. These attacks often serve as signals of underlying security weaknesses that can later be leveraged for more serious intrusions. Alongside defacements, ransomware activity has also begun to emerge within the country’s threat landscape, reflecting broader global trends in cybercrime.

This report examines Bangladesh’s evolving digital threat environment through data observed across multiple monitoring sources. By analyzing defacement activity alongside ransomware claims, it becomes possible to identify patterns in how cybercriminal groups discover, target, and exploit organizations within the country.

Building on this broader context, the investigation then narrows its focus to a specific ransomware operation that surfaced during the analysis. By tracing the group’s infrastructure, communication channels, and operational ecosystem, this report provides insight into how international ransomware actors intersect with Bangladesh’s growing cyber threat landscape.

Bangladesh’s Emerging Digital Threat Landscape

To better understand the scope of cyber activity affecting Bangladesh, StealthMole’s monitoring capabilities were used to examine indicators of compromise across multiple threat intelligence sources. The analysis began with StealthMole’s Defacement Alert (DA) tool, which tracks publicly reported website defacements across the internet.

A search for Bangladesh-linked victims revealed a significant volume of activity. Between January 2023 and March 2026, the DA tool identified approximately 1,512 defacement incidents involving websites hosted in Bangladesh. These incidents span a wide range of sectors, including educational institutions, commercial businesses, and small organizational websites. In many cases, defacements target publicly accessible web servers, often exploiting misconfigured systems, outdated software, or weak administrative protections.

While website defacements are sometimes dismissed as low-level cyber vandalism, they often act as an early indicator of deeper security weaknesses. Public-facing vulnerabilities exploited during defacements can expose entry points that more sophisticated threat actors may later leverage for persistent access, data theft, or extortion-based attacks.

To determine whether ransomware activity was also present within Bangladesh’s threat environment, the investigation expanded to StealthMole’s Ransomware Monitoring (RM) tool. This platform aggregates ransomware leak site data, tracking victims claimed by various ransomware groups across the dark web.

The results showed that ransomware groups have also targeted organizations in Bangladesh. Between May 2021 and January 2026, the RM tool recorded 22 ransomware victims associated with entities located in Bangladesh. These incidents involve multiple ransomware groups and affect organizations operating in sectors such as manufacturing, retail, and corporate services.

Although the number of ransomware victims appears smaller compared to defacement incidents, ransomware operations typically represent far more damaging intrusions. These attacks often involve network compromise, data exfiltration, and extortion campaigns that can disrupt operations and expose sensitive information.

Among the victims identified during this review, one case in particular stood out during the analysis and became the starting point for a deeper investigation into the ransomware ecosystem connected to Bangladesh.

Incident Trigger and Initial Investigation

Following the broader review of Bangladesh’s ransomware exposure using StealthMole’s Ransomware Monitoring (RM) module, one listing in particular stood out during the analysis. StealthMole identified a Bangladesh-based textile manufacturing company, as a victim claimed by the ransomware group NightSpire.

To investigate the threat actor responsible for the claim, the analysis shifted toward NightSpire’s infrastructure. Using StealthMole’s Dark Web Tracker, the ransomware group’s leak site was identified at:

• a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion

Snapshots captured from the site revealed the group publicly threatening organizations whose data had allegedly been stolen. One message posted on the platform stated that 1TB of data had been copied from a victim organization, warning that the information would be released publicly if negotiations did not take place within a specified timeframe. The site also included sample records and download links intended to demonstrate the authenticity of the stolen data.

Further examination of the leak site indicated that NightSpire was not operating solely as a ransomware actor but was actively promoting a Ransomware-as-a-Service (RaaS) model. The platform openly advertised opportunities for affiliates to join the operation, suggesting that the group was attempting to expand its network of operators and increase the scale of its attacks.

This discovery prompted a deeper investigation into the group’s infrastructure, communication channels, and recruitment activities across the dark web ecosystem.

Mapping the NightSpire Ransomware Infrastructure

After identifying NightSpire as the ransomware group claiming the compromise of Premier 1888 Ltd., the investigation shifted toward understanding the broader infrastructure used by the group. Rather than relying solely on a single leak portal, StealthMole analysis revealed that NightSpire maintains a network of interconnected onion domains, communication channels, and file-hosting infrastructure that together support its ransomware operations.

The investigation therefore expanded to map these elements and determine how the group structures its operational ecosystem.

Primary Leak Site Infrastructure

The initial pivot began with the leak site identified through StealthMole’s Ransomware Monitoring module:

• a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion

StealthMole records indicate that this domain functioned as one of NightSpire’s primary leak portals. The page structure included listings of victim organizations, descriptions of stolen data, and timestamps indicating when intrusions allegedly occurred. The site also displayed warnings to victims that stolen data would be publicly released if negotiations failed.

The portal followed a pattern commonly seen in ransomware leak platforms, where attackers attempt to pressure victims by publicly advertising compromised organizations and threatening staged data leaks.

Associated Onion Infrastructure

Further analysis of the primary leak domain uncovered additional onion services connected to NightSpire. These domains appear to represent different components of the group’s infrastructure, potentially serving purposes such as leak hosting, negotiation portals, or content distribution.

Two additional domains were discovered through StealthMole’s Dark Web Tracker:

• nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion
• nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion

Both domains were inactive at the time of analysis. However, historical snapshots suggest they previously hosted content associated with the NightSpire operation.

Further investigation revealed an additional onion service:

• nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion

This page appeared to function as a NightSpire chat or negotiation portal, requiring visitors to complete a CAPTCHA verification before accessing the communication interface.

Another domain later identified through Telegram-linked references was:

• nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion

Unlike the earlier infrastructure, this site presented itself as a NightSpire blog and information portal, containing sections for news updates, leaked data, contact information, and affiliate recruitment.

The presence of multiple onion domains suggests that NightSpire operates a distributed infrastructure rather than relying on a single leak platform.

Malware Hashes Linked to the Operation

StealthMole’s Dark Web Tracker also revealed six malware hashes associated with the NightSpire infrastructure. These hashes likely correspond to files distributed through the group’s ecosystem, potentially including ransomware payloads, tooling, or related operational artifacts.

The identified hashes include:

• d5f9*********************************************a6
• c285*********************************************53
• e275*********************************************3d
• 32e1*********************************************a5
• f017*********************************************a1
• dbf0*********************************************d7

• nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion

This overlap indicates that multiple NightSpire domains may distribute or reference the same set of malicious files, reinforcing the likelihood that these domains belong to a unified operational infrastructure.

External File Hosting Infrastructure

In addition to onion-hosted resources, the investigation identified nine MEGA file-hosting links associated with the NightSpire infrastructure.

The use of external cloud storage platforms is a tactic frequently observed in ransomware operations. These services may be used to host:

• sample data used as proof of compromise
• staged data leaks
• operational tooling
• ransomware payload files

Although the exact content of the hosted files was not directly examined during this investigation, the presence of multiple cloud-hosting links suggests that NightSpire supplements its dark web infrastructure with external storage platforms to distribute or archive stolen data.

Communication Channels and Contact Identifiers

The NightSpire infrastructure also revealed multiple communication channels intended for negotiations and operational coordination.

The following identifiers were observed across several NightSpire domains:

Email addresses

• nightspire********@onionmail.org
• nightspire************@proton.me
• nightspire*******6@onionmail.org
• nightspire*********6@proton.me

Telegram

• https://t.me/nightspire******5

Notably, the Telegram link pointed to an individual user account rather than a broadcast channel, suggesting that the platform may be used for direct negotiations or private communication.

Session ID

• 057d49****************************************a02

TOX IDs

• 3B61CF**************************************************7E6
• 8D663F**************************************************E7F
• 038F6***************************************************9EA

The presence of multiple encrypted messaging platforms suggests that NightSpire maintains redundant communication methods to ensure continued contact with victims and affiliates even if individual services are disrupted.

Evidence of Ransomware-as-a-Service (RaaS) Activity

In addition to infrastructure and communication channels, the investigation uncovered indicators suggesting that NightSpire operates under a Ransomware-as-a-Service model.

One underground forum discussion referenced NightSpire alongside other ransomware groups as a potential RaaS operation that individuals could join. Additionally, pages discovered within the NightSpire ecosystem contained messages inviting actors to become affiliates and participate in the group’s operations.

This suggests that the group may rely on a decentralized network of affiliates who deploy ransomware using the infrastructure provided by the NightSpire operators.

NightSpire’s Organizational Narrative and Affiliate Recruitment

Further examination of the NightSpire ecosystem revealed additional insight into how the group presents itself and attempts to structure its operations. Within the blog infrastructure previously identified, the About page provides a detailed narrative describing the group as an organized collective of cybersecurity specialists rather than a conventional ransomware gang.

The page characterizes NightSpire as an “elite red team collective”, claiming expertise in advanced penetration testing, vulnerability discovery, and network infiltration. According to the site, the group consists of a coordinated team of specialists responsible for different aspects of cyber operations.

The page listed several individuals described as members of the group’s team, each associated with a specific role:

• Phantom – Lead Infiltrator
• Reaper – Exploit Developer
• Volt – Network Breach Specialist
• Blaze – Red Team Commander
• Shadow – Malware Engineer
• Blade – Web Application Hacker

The page also includes numerical claims regarding the group’s activities, referencing dozens of compromised systems and vulnerabilities discovered during their operations.

Alongside this organizational narrative, the NightSpire platform also contains clear indicators that the group is attempting to expand its operations through an affiliate-based model. A dedicated affiliate recruitment interface encourages external actors to collaborate with the group, effectively turning NightSpire’s infrastructure into a platform that others can use to conduct attacks. Access to the affiliate portal is gated behind a CAPTCHA verification step, suggesting that the operators are attempting to restrict automated scanning while allowing prospective partners to initiate contact.

Messaging associated with the recruitment process emphasizes opportunities for participants to join NightSpire’s campaigns and leverage the group’s infrastructure and tooling. This approach aligns with a Ransomware-as-a-Service (RaaS) model, in which the core operators maintain the underlying ransomware infrastructure while independent affiliates carry out intrusions and deploy the ransomware in exchange for a share of the profits.

Overall, the About page and affiliate recruitment mechanisms present a carefully constructed public image of the operation. On one level, NightSpire attempts to portray itself as a technically skilled red-team collective engaged in advanced cybersecurity activities. At the same time, the group actively maintains ransomware leak sites, negotiation portals, and recruitment channels intended to support extortion campaigns.

This contrast highlights how some ransomware groups attempt to frame their activities in terms that resemble legitimate security work, even while operating infrastructure designed to facilitate data theft and ransom negotiations.

Conclusion

This investigation began with a review of Bangladesh’s cyber threat landscape and eventually narrowed to a ransomware operation linked to the NightSpire group. The appearance of a Bangladesh-based textile company on the group’s leak platform served as the initial trigger that led to a deeper examination of the infrastructure and operational elements behind the campaign.

The analysis revealed that NightSpire maintains a structured ecosystem consisting of multiple onion domains, encrypted communication channels, cloud-hosted resources, and an affiliate recruitment mechanism, suggesting an operation designed to scale through external collaborators.

One of the most significant artifacts uncovered during the investigation was the set of malware hashes associated with the group’s infrastructure. Unlike domains, communication channels, or branding, which threat actors frequently rotate, abandon, or rebrand, malware hashes provide a far more persistent technical fingerprint. Even if NightSpire were to modify its public identity, migrate its infrastructure, or reappear under a different name, these hashes could still serve as durable indicators linking future activity back to the same operational tooling or malware family.

Viewed in the broader context of Bangladesh’s evolving cyber threat environment, the NightSpire case illustrates how international ransomware operations intersect with emerging digital ecosystems. As organizations continue to expand their online presence, maintaining visibility into both threat actors and the technical artifacts they leave behind will remain essential for understanding and responding to future campaigns.

Editorial Note

Attribution and capability assessment in cyber investigations are rarely absolute. Online identities can be replicated, exaggerated, or strategically framed for visibility. This case demonstrates how fragmented signals can be methodically assembled to identify patterns without overextending conclusions using StealthMole.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com