Toronto-based web registrar linked to Iranian intelligence operation aiming to kill Canadian activist

TORONTO — A U.S. federal investigation has revealed that an alleged Iranian intelligence-linked plot targeting an Ottawa-based Iranian-Canadian activist relied in part on Canadian internet infrastructure and international cryptocurrency transfers, according to newly unsealed court documents.The affidavit, released by the U.S. Department of Justice, alleges that Iran’s Ministry of Intelligence and Security (MOIS) offered a US$250,000 bounty for the killing of former Ontario Progressive Conservative MPP Goldie Ghamari, with the threat directed to members of the Jalisco New Generation Cartel.The findings were first reported by Sam Cooper of The Bureau.According to the court filing, the threat network included a series of websites operated under cyber personas such as “Handala Hack,” “Karma Below,” and “Homeland Justice,” which investigators allege were part of a coordinated MOIS operation targeting dissidents, journalists and others..The affidavit states that two of the domains later seized by U.S. authorities — justicehomeland.org and karmabelow80.org — were registered through Tucows Domains Inc., a Toronto-based registrar.The company provides privacy protection services that allow website owners to shield their identities in public registration records. Investigators suggested this feature was used in the case, though the filing does not allege wrongdoing by the company.A third domain, handala-hack.to, was allegedly used to publish personal data of targets and disseminate threats, including material encouraging violence.Financial transactions linked to the operation were traced through multiple layers of cryptocurrency exchanges, according to the affidavit.Investigators said funds used to purchase one of the domains were routed through a Hong Kong-based automated exchange service before being linked to Ramzinex, an Iranian cryptocurrency platform headquartered in Tehran.The document states the use of multiple conversions and intermediary transfers appeared designed to obscure the origin of funds..The affidavit alleges that Ghamari and Los Angeles-based Iranian-American lawyer Elica Le Bon were directly threatened.In one message cited in the filing, the perpetrators claimed cartel operatives had been provided with home addresses and warned the targets they would be “executed soon.”The same network is also accused of publishing personal data of individuals it alleged were connected to the Israeli military and of encouraging others to act against them.U.S. investigators allege the cyber personas formed part of a broader campaign that included hacking operations, data leaks and malware attacks.The affidavit states that one cyberattack attributed to the network disrupted emergency services at hospitals in Maryland.Cybersecurity firms tracking the activity have identified the group under various names, including Void Manticore, Storm-0842 and Banished Kitten..Ghamari, who has publicly criticized Iran’s government, responded to the reporting on social media, confirming she was the subject of the threats.In a previous interview with The Jerusalem Post, she said Canada hosts hundreds of individuals affiliated with the Iranian regime and expressed concern about government response.Separately, RCMP Commissioner Mike Duheme said in an interview with CTV News that while cases of intimidation and harassment linked to foreign interference have been documented, investigators have not established direct connections to foreign states in those files.The DOJ affidavit detailing the alleged plot was unsealed the same day the interview was reported.The court document does not identify the country where alleged cartel operatives were located at the time of the threat, referring only to a “redacted foreign country.”

Toronto-based web registrar linked to Iranian intelligence operation aiming to kill Canadian activist

Related Stories