Justice Department Shuts Down Websites Allegedly Used by Iranian Government
Justice Department seized four domains used by Iran's Ministry of Intelligence and Security to disrupt hacking and transnational repression schemes.
Objective Facts
The Justice Department announced the seizure of four domains—Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to—used by Iran's Ministry of Intelligence and Security in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons. The Handala sites were allegedly used to take credit for a destructive malware attack against a U.S.-based multinational medical technologies firm; Stryker reported a cyberattack last week that caused "global disruption," and cybersecurity expert Brian Krebs indicated Handala appeared to claim responsibility for the incident, which was ostensibly in retaliation for a deadly bombing of a girls' school in Iran. Handala was accused of emailing death threats to Iranian dissidents and journalists, with one alleged message claiming Handala was "partners" with the Mexico-based Jalisco New Generation Cartel and offered a $250,000 reward for the target's death.
Left-Leaning Perspective
Search results did not uncover substantive left-leaning or progressive coverage offering distinct framing, criticism, or alternative analysis of the Justice Department's seizure of the Iranian government websites. Major left-of-center outlets (CNN, MSNBC-affiliated sources) reported the story largely through a national security framework without visible partisan differentiation from center or right-wing coverage. This suggests either consensus on the issue or minimal progressive commentary engaging with the seizures as a newsworthy political development. The absence of critical left-leaning coverage stands in contrast to what might be expected on issues involving government internet enforcement, domain seizures, or foreign policy actions, where progressive outlets often raise concerns about precedent or proportionality. No sources were found questioning the legal basis of the seizures, raising civil liberties concerns about internet governance, or offering counterarguments about attribution certainty. This pattern may reflect the severity of documented activities—death threats involving cartel partnerships, doxing of 190 Israeli officials with explicit threats, and targeting of Jewish communities—which appears to have created broad agreement that the action was justified.
Right-Leaning Perspective
Right-leaning outlets featured Attorney General Pamela Bondi's characterization of the move as "a vital strike against state-sponsored extremism," with the statement that "Terrorist propaganda online can incite real-world violence" and "This network of Iranian-backed sites will no longer broadcast anti-American hate." The Daily Wire described it as a "major escalation against foreign cyber threats," emphasizing that the sites were used to leak stolen data, dox dissidents, and incite violence against American citizens, journalists, and Israeli officials. FBI Director Kash Patel stated "Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans" and vowed the FBI would "hunt down every actor behind these cowardly death threats," with Assistant Attorney General John A. Eisenberg describing Iran as "the leading state sponsor of terrorism worldwide." Coverage noted that simply seizing the group's domains were unlikely to thwart cyberattacks for long, as Iran has spent years bolstering its cyber capabilities, with Microsoft's security division warning that Iran shows no sign of slowing its cyber attack efforts. Right-wing outlets framed the seizure as an overdue enforcement action against a coordinated state-backed cyber campaign, emphasizing the personal threats to named individuals (Canadian politician Goldie Ghamari, Iranian dissidents) and the Stryker medical device company attack as evidence of escalating Iranian aggression. The narrative focused on Tehran's willingness to partner with criminal organizations and target civilian infrastructure.
Deep Dive
The seizure occurs within a broader context: on February 28, 2026, the United States and Israel launched a significant joint offensive against Iran, and in the hours following, Iran began a multi-vector retaliatory campaign that has evolved into a significant trans-regional conflict. The move comes amid fears that the U.S. and Israel's war with Iran could expand into cyberattacks, with a news agency linked to the Iranian Revolutionary Guards having threatened American tech companies as targets, and one of the Iran-linked groups appearing to take credit for a hack on a Michigan medical technology company. The Iranian cyberthreat landscape shows a recurring pattern in which Iran has made deliberate efforts to deputize hacktivist proxies in state actions without state attribution, creating a coordinated cyber threat comprised of state-sponsored advanced persistent threat actors from the Islamic Revolutionary Guard Corps and the Ministry of Intelligence, combined with an expanding ecosystem of opportunistic hacktivist groups. The FBI's investigation revealed that email accounts linked to the domains were used to send death threats to Iranian dissidents and journalists, with Handala Hack offering bounties and openly calling for criminal cartel partners to commit acts of violence against targets. What remains unresolved: Cybersecurity researchers noted that Handala has already set up new domains that have not yet been seized, suggesting the seizure may be a temporary disruption rather than a terminal blow to the operation. During late February and early March 2026, researchers observed Handala traffic originating from Starlink satellite IP ranges, indicating the group has maintained tactical autonomy and command-and-control capabilities despite Iran's internet blackout. The absence of left-leaning critical analysis in available sources may reflect either genuine consensus on the severity of the threat or a gap in progressive commentary on the seizure as a civil liberties or precedent issue.