DOJ Seizes Iranian Intelligence Websites Behind $250,000 Beheading Bounty on Canadian Politician — Cartel Directed to Kill Her at Ottawa Home

Iran's Ministry of Intelligence and Security used a Mexican drug cartel as a threat against a Canadian politician. The Justice Department just shut the network down.

Goldie Ghamari posted this image to her Facebook page on March 1, 2026, alongside the death threat she received from the Islamic Republic-linked Handala Hack Team, which directed the Jalisco New Generation Cartel to kill her at her Ottawa home. Photo: Goldie Ghamari/Facebook

WASHINGTON/OTTAWA — The United States Department of Justice announced today the court-authorized seizure of four websites operated by Iran’s Ministry of Intelligence and Security, dismantling a regime-run cyber and psychological operations network that issued a $250,000 bounty death threat against former Ontario Member of Provincial Parliament Goldie Ghamari, which directed the Jalisco New Generation Cartel to behead her at her Ottawa home.

The Iranian cyber operations also targeted journalists, Jewish communities, Israeli defense personnel, and Iranian dissidents across North America.

“Terrorist propaganda online can incite real-world violence,” Attorney General Pamela Bondi said. “This network of Iranian-backed sites will no longer broadcast anti-American hate.”

The four seized domains were used by the Ministry of Intelligence and Security to orchestrate what the Justice Department described as “faketivist” psychological operations: claiming credit for hacking campaigns, publishing stolen personal data on targeted individuals, and issuing explicit calls for violence against dissidents, journalists, and members of Jewish communities.

Court documents filed in the United States District Court for the District of Maryland, unsealed today, reveal the full operational scope of the network, which investigators traced through Iranian internet protocol ranges, shared infrastructure, and cryptocurrency transactions routed through a Tehran-based exchange directly to the actors behind the domains.

At the center of the Canadian dimension of the case is Ghamari, a former Progressive Conservative member of provincial parliament for Carleton who since leaving office has become one of the most prominent Iranian-Canadian voices publicly condemning the Islamic Republic.

On March 1, 2026, according to the unsealed affidavit, the Ministry of Intelligence and Security used the email account Handala_Team@outlook.com to send a death threat to two women — one located in the United States, one abroad. The Bureau has confirmed, based on Ghamari’s own public statements and her posting of the identical threat language, that she is one of the two named victims.

The subject line of the email read: “Death to [redacted victim names].” The body of the message, reproduced in full in the affidavit, stated: “We the Handala Hack team, the loyal followers of the supreme leader Ali Hosseini Khamenei, declare war on all the enemies of Islam in the West. Our partners, the CJNG [Jalisco New Generation Cartel] cartel in America and Canada have been given a list of our enemies who are responsible for our great leaders [sic] death.

You laughed like hyenas during the [redacted] show. We have hacked and revealed your home addresses in [redacted U.S. city] and [redacted] to our partners in the CJNG who are in [redacted U.S. state] and [redacted foreign country] now. Both of you will be executed soon, and we have offered a reward of $250,000 for the operatives who kills [sic] and beheads both of you. ALLAHU AKBAR.”

“By leveraging online platforms linked to the domain, MOIS sought to amplify its online threats, pressure critics, and discourage independent reporting, while creating fear among members of the Iranian diaspora critical of the regime,” a DOJ statement explained.

In a statement posted to Facebook that same day and reviewed by The Bureau, Ghamari wrote: “I just received a death threat by Islamic Regime-linked hacker group ‘Handala Hack Team’ from the e-mail address: Handala_Team@outlook.com. ‘Death to Elica le Bon and Goldie Ghamari.’”

The second target is Iranian-American lawyer and activist Elica Le Bon, based in Los Angeles.

Both women had recently appeared together on Piers Morgan Uncensored. Ghamari confirmed she filed a police report and was told by law enforcement that the threat was being taken “very seriously.”

She told the Jerusalem Post that the bounty illustrated a systemic failure: “There are at least 700 people in Canada who are known to be affiliated with the regime. Canada is basically one of the destinations for people who are affiliated with the Islamic regime. The government has not done much.”

Days before the threat was issued, Prime Minister Mark Carney stated publicly that he did not believe there were imminent terrorist threats to Canadians on Canadian soil. “Within the span of 24 hours, there have been at least two known terror incidents,” Ghamari later commented.

The network’s reach extended well beyond the threat against Ghamari.

On March 11, 2026, the group claimed responsibility for a destructive malware attack against a major American multinational medical technologies firm — with direct consequences for civilian safety.

According to court documents, the firm issued an internal memo that the hack had a direct impact on emergency medical services and hospitals throughout Maryland, forcing clinicians to abandon digital systems and rely on radio consultation and verbal communication to manage patient care.

By March 9, one of the seized domains had published the names, photographs, and sensitive personal data of approximately 190 individuals associated with the Israeli Defense Force or Israeli government, with explicit language warning that targets were being monitored and that consequences would follow.

On March 6, the group posted 851 gigabytes of data it claimed to have stolen from members of the Sanzer Hasidic Jewish community, warning: “No place is safe for you.”

Investigators also documented the targeting of a journalist at a United Kingdom-based Farsi-language news organization, who was contacted via Telegram and infected with malware that gave Iranian intelligence actors remote access to the journalist’s computer.

The three cyber personas behind the seized domains — Handala Hack, Karma Below, and Homeland Justice, operating respectively at Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to — are formally attributed in the affidavit as a single Ministry of Intelligence and Security conspiracy.

The affidavit also documents an undercover Federal Bureau of Investigation operation in which an agent purchased stolen Albanian government data — including national identity card records and sensitive personal information on Albanian citizens — from the network via Telegram in March 2025, for Bitcoin, establishing that the same actors were engaged in active criminal commerce more than a year before today’s takedown.

Blockchain analysis revealed that the Litecoin used to register one of the seized domains was sourced, through intermediary cryptocurrency conversions, from Ramzinex — a prominent Iranian cryptocurrency exchange headquartered in Tehran — confirming the network’s financing traced directly to the Iranian state.

The use of the Jalisco New Generation Cartel as an execution proxy for Iranian intelligence represents a documented escalation in the operational relationship between the Islamic Republic and Latin American criminal organizations.

“There are longstanding money-laundering and trafficking ecosystems that connect Latin American cartels, Iranian state-aligned networks and global criminal finance,” this reporter told Iran International regarding broader known threats across North America earlier this month.

The Justice Department’s affidavit now provides the legal predicate for that nexus — suggesting that the Ministry of Intelligence and Security does not merely coordinate financially with cartel networks, but operationally directed them against named targets on Canadian and American soil.