 |
A pro-Islamic regime hacker group that sent death threats to former Ontario MPP Goldie Ghamari earlier this month was named as one of four Iranian intelligence operations shut down by the U.S. government. One of their threats stated that a bounty of $250,000 was placed on her head and information on her and another’s location in the US was provided to members of CJNG.
The FBI announced it took down four websites facilitating Iran’s Ministry of Intelligence and Security (MOIS) hacking efforts. The DOJ says these efforts were tied to “psychological operations and transnational repression.”
A website used by the Iranian government-linked hacking group Handala Hacks, that claimed responsibility for a March 11 cyberattack on a U.S. medical device maker Stryker is back up and running a day after the FBI and DOJ seized its internet domains.
Handala said in a post on its website Friday that the seizures were “desperate attempts by the United States and its allies to silence the voice of Handala.”
Handala Hack, was tracked by Check Point Research as an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The group has several online personas, one of the most prominent among them being HomeLand Justice during a 2022 cyber attack on the Government of Albania.
The group, which first appeared in late December 2023, first drew attention this month after claiming attacks on Verifone and Stryker, two major US companies it framed as retaliation targets because of their ties to Israel.
The email issued a $250,000 bounty death threat against former Ontario Member of Provincial Parliament Goldie Ghamari, which directed the CJNG, Jalisco New Generation Cartel, to behead her at her Ottawa home.
“Both of you will be executed soon,” the email to Goldie Ghamari read, “and we have offered a reward of $250,000 for the operatives who kill both of you.” The second target was Elica Le Bon, an Iranian-American lawyer and activist based in Los Angeles, California.
 |
Online Death Threats
 |
Ghamari, a former Progressive Conservative member of provincial parliament for Carleton who since leaving office has become one of the most prominent Iranian-Canadian voices publicly condemning the Islamic Republic.
“I have a very successful YouTube channel. I livestream every day in English, and the purpose of the channel is to raise awareness about what’s happening in occupied Iran [and] this is obviously a threat to the Islamic regime. It does not like the fact that people are learning the truth, and so it is trying to attack me,” she said.
The use of the CJNG as an execution proxy for Iranian intelligence represents a documented escalation in the operational relationship between the Islamic Republic and Latin American criminal organizations.
US “Mafia” Plot Foiled
Merchant admitted that he began working for the IRGC in Pakistan in late 2022 or early 2023, when he received training in tradecraft, including countersurveillance. Later in 2023, he was sent to the United States to look for potential IRGC recruits who could stay behind in the United States. Merchant testified that he knew that the IRGC was a designated terrorist organization. Throughout this period, Merchant repeatedly traveled to Iran to meet with his IRGC handler.
Merchant testified that in 2024, he was sent back to the United States with a new mission: to recruit “Mafia” members to steal documents, stage a protest, and arrange the murder of one of three specific U.S. government officials and politicians. To that end, Merchant contacted an acquaintance in New York who he thought could help him with his scheme. That person, Nadeem Ali, instead reported Merchant’s conduct to law enforcement and became a confidential source.
In early June, Merchant met Ali in New York and explained his assassination plot. Merchant told Ali that he had an ongoing opportunity for him and then made a “finger gun” motion with his hand, indicating that the opportunity was related to a killing. Merchant further stated that the intended victims would be “targeted here,” in the United States. Merchant instructed Ali to arrange meetings with individuals whom Merchant could hire to carry out these actions.
“Iran’s terrorist regime sent Asif Merchant here to sow mayhem and murder,” stated United States Attorney Nocella for the Eastern District of New York. “Thanks to the vigilance of our law enforcement partners, his scheme ended in failure. Today, with Merchant’s conviction, that failure is complete. This Office will always remain vigilant in our mission to protect the United States from foreign terrorist adversaries.”
Iran’s Criminal Group Connections
In recent years, with heavy sanctions and intelligence agencies tracking Iranian movements; the regime has contracted out to several criminal organizations for procuring weapons and to assassinate dissidents on foreign soil, including the US. Several of these organizations have connections to Iran and terror groups such as Hezbollah through the underground money exchange network known as Hawala.
Kinahan Cartel
In 2015, a man was shot dead in the Netherlands, he had been living in hiding for over two decades. The person who coordinated the hit from Iran was arrested in a Dublin safehouse belonging to the Kinahans.
It is also said that the Kinahans, having been sanctioned as well have been laundering drug money through Iranian banks.
 |
Recently, the US charged several men, including a full patch member of the Hells Angels based in British Columbia, Canada, with conspiring with high-level Iranian drug trafficker Naji Zindashti, to have a dissident and their spouse killed in Maryland.
Russian Thieves-In-Law
A similar conspiracy went a step further when police stopped a man near the New York home of journalist Masih Alinejad, who is critical of Iran and a woman’s rights activist. He had an AK-47 in the car and had been contracted by Rafat Amirov, known as “Rome,” a known member of Russian organized crime from the Czech Republic.
