Iran International
A senior Iranian intelligence official and a network of operatives have been identified as key figures in a cyber group that targeted London-based broadcaster Iran International and its staff, according to information obtained by the channel.
The hacking group, known as “Handala,” is tied to the Iranian Ministry of Intelligence’s Domestic Security Directorate and operates as part of a broader cyber unit known as “Banished Kitten” — also referred to as Storm-0842 or Dune.
This unit falls under the supervision of Yahya Hosseini Panjaki, the ministry’s deputy for domestic security. Panjaki was sanctioned by the United States in 2024 over alleged plots to assassinate Iranian dissidents abroad, a few months after his identity was exposed by Iran International.
The broadcaster said the latest findings show that the July cyber operation was intended to intimidate journalists and disrupt their work, with the group publishing personal documents, private images, and screenshots from an editorial meeting.
According to information obtained by Iran International, one of the identified operatives is Ali Bermoudeh, a 27-year-old from Tabriz who runs an online store and has previously worked with Iran’s cyber police (FATA).
One source said that "Bermoudeh is an amateur hacker whose passwords for many of his main accounts are simply his date of birth. All his user credentials with that same password are stored with one service provider."
According to the source, he has been gathering user data for security agencies since his teenage years, and he is connected to the network through his father Mousa Bermoudeh, a provincial official with the state-affiliated Foundation of Martyrs and Veterans Affairs and a decorated IRGC Basij member.
The group also includes Morteza Aftabifar, said to be Bermoudeh’s handler within the Ministry of Intelligence.
Both men are from Tabriz, as is Panjaki, who heads the larger project within which the cyber unit operates.
Panjaki is described as part of a newer generation of intelligence managers trusted by Supreme Leader Ali Khamenei, with a background in political science from Azad University of Tabriz. He also founded a “Qassem Soleimani Headquarters” within the ministry, coordinating with the Islamic Revolutionary Guard Corps on overseas operations, the channel has learned.
In July, Iran International confirmed that leaked materials published by Iranian state outlets came from earlier hacks in summer 2024 and January 2025, which it attributed to Banished Kitten.
The channel said the hackers may have installed malware via compromised Telegram accounts. “These cyberattacks are part of a broader campaign of threats targeting Iran International, including physical threats against our staff.”
Iran International, which reports on events in Iran and the wider region, said its staff had faced sustained harassment since the channel was founded in 2017, including threats of assassination and kidnapping, physical assaults, online abuse, and hacking.
British lawmakers have accused Iran of engaging in “transnational repression” on UK soil, citing assassination plots, intimidation of family members, asset freezes, smear campaigns, and cyberattacks.
Lawyers for the broadcaster’s staff say 45 journalists and 315 of their relatives have been threatened in recent weeks, with death threats issued if they did not resign by set deadlines.
The channel has also been the focus of physical threats: in 2023 a man was convicted under terrorism laws after filming outside its premises, and in 2024 a presenter was stabbed in London.
Iran International said earlier in August that it had filed an urgent appeal to United Nations experts over “serious risks to the lives and safety” of its journalists worldwide and their relatives inside Iran.
US-based advocacy group United Against Nuclear Iran (UANI) called on Washington and its European allies to confront Iran’s transnational repression, which it says has escalated since the start of a 12-day war between Iran and Israel in June.
