DOJ Shuts Down Iranian Regime Websites Connected to Death Threat Against Former Ontario MPP

The U.S. Department of Justice (DOJ) says it has seized four websites operated by the Iranian regime’s intelligence department that were allegedly behind a $250,000 bounty death threat against former Ontario MPP Goldie Ghamari.

The DOJ announced the seizure in a March 19 press release, saying it came as part of its “ongoing effort to disrupt hacking and transnational repression schemes” conducted by the Iranian regime’s Ministry of Intelligence and Security (MOIS).

The seized domains, Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to, were used by the MOIS to facilitate “attempted psychological operations targeting adversaries of the regime,” the DOJ said.

The department said the MOIS used the domains to claim credit for hacking activity, to post sensitive data stolen during hacks, and to call for the killing of journalists, Iranian regime dissidents, and Israeli persons.

The redacted court filing says the investigation found the MOIS used cyber personas “Homeland Justice/Justice Homeland,” “Karma Below,” and “Handala Hack” to carry out such activity.

“Terrorist propaganda online can incite real-world violence — thanks to our National Security Division and the U.S. Attorney’s Office for the District of Maryland, this network of Iranian-backed sites will no longer broadcast anti-American hate,” U.S. Attorney General Pamela Bondi said in the DOJ press release.

FBI Investigators found that the four websites were linked to each other through shared leak sites, Iranian IP ranges, and a common operational “playbook,” including “destructive and disruptive cyber-attacks; and ‘faketivist’ psychological operations using data stolen via hacking,” the DOJ said.

The DOJ also said the MOIS used the email account Handala_Team@outlook.com to send death threats to Iranian dissidents and journalists, and the account was used on March 1 to email two victims, “located in the United States and abroad.”

It was first reported by The Bureau that the news organization had confirmed that Ghamari, a prominent Iranian Canadian who has been publicly critical of the Iranian regime, was one of the two victims targeted on March 1, based on public statements from Ghamari including a post containing the same threat language contained in the redacted court filing.

According to the court filing, the email’s subject line reads “Death to [redacted names]”. It also says the body of the message indicates that Mexican cartel group Jalisco New Generation Cartel had been directed to execute both victims, and there was a $250,000 reward for the beheading of the victims.

“We the Handala Hack team, the loyal followers of the supreme leader Ali Hosseini Khamenei, declare war on all the enemies of Islam in the West. Our partners, the CJNG [Jalisco New Generation Cartel] cartel in America [redacted] have been given a list of our enemies who are responsible for our great leaders [sic] death,” the email said, according to the court filing.

The email also said Handala Hack had hacked and revealed the victims’ home addresses to its partners in the cartel group, and that both victims would be executed “soon.”

Ghamari posted on Facebook on March 1, saying: “I just received a death threat by Islamic Regime-linked hacker group ‘Handala Hack Team’ from the e-mail address: Handala_Team@outlook.com.”

She included the email message in her post, which appears to be identical to the one included in the U.S. court filing but includes the redacted information. The subject line of the email read: “Death to Elica le Bon and Goldie Ghamari,” according to Ghamari.

“Elica le Bon and Goldie Ghamari, you laughed like hyenas and called for war on our great leader during the Piers Morgan show,” the body of the unredacted email said, according to Ghamari’s post.

Ghamari and Elica Le Bon, an Iranian-American lawyer and activist based in Los Angeles, appeared on Piers Morgan Uncensored on Feb. 24 where they expressed support for the United States sending military fleets to Iran after widespread protests broke out across Iran in late December. The protests initially began in response to rising living costs and a sharp drop in the value of the national currency, but later called for the overthrow of the Islamic Republic in Iran.

Ghamari told The Jerusalem Post earlier this month that she is concerned for her life after receiving the death threat. She said she filed a police report and noted that law enforcement was taking the incident “very seriously.”

Acts of Violence

The death threats came after the United States and Israel launched airstrikes against Iran on Feb. 28 after negotiations over Iran’s nuclear program broke down. The attack killed Iranian leader Ayatollah Ali Khamenei as well as several leaders of the Islamic Revolutionary Guard Corps (IRGC), and Iran responded with retaliatory missile and drone strikes against Israeli and U.S. military positions in the region.

Acts of violence in Canada have escalated since the onset of the war in Iran. In the days following the initial attack, multiple shootings took place at synagogues in the Toronto area including two on March 7 and another on March 2, while a Toronto-area gym owned by an Iranian-Canadian activist was shot at 17 times on March 1.

The U.S. Consulate in Toronto was also targeted by gunfire on the morning of March 10. The shooting investigations are ongoing, and police have not yet arrested any suspects. No injuries were reported as a result of the shootings.

The RCMP also launched a homicide investigation in early February after Iranian activist Masood Masjoody went missing in British Columbia. Two suspects were charged on March 13 with first-degree murder after Masjoody’s remains were found in the province. Masjoody had posted on social media last October alleging the two suspects were out to kill him.