
Iranian intelligence operatives have partnered with a Mexican drug cartel to issue a $250,000 beheading bounty on a former Canadian politician who dared expose the regime’s atrocities, revealing a chilling new front in foreign terror operations targeting American allies on our doorstep.
Story Snapshot
- Iran’s Ministry of Intelligence directed hackers to offer CJNG cartel $250,000 for beheading former Ontario MP Goldie Ghamari at her Ottawa home after leaking her address
- U.S. DOJ seized four Iranian government domains used for “psychological operations” threatening dissidents, exposing direct state sponsorship of transnational terror
- Threats target Iranian-Canadian activists speaking out against regime brutality while Canada harbors approximately 700 Iranian operatives with minimal government action
- Attack represents unprecedented coordination between state-sponsored cyber warfare and cartel violence to silence critics abroad
Iranian State Hackers Partner With Mexican Cartel for Terror
The Iran-linked group Handala Hack posted a death threat on March 1, 2026, offering the Jalisco New Generation Cartel $250,000 to behead Goldie Ghamari, a former Ontario Progressive Conservative MP turned YouTube activist. The threat detailed her Ottawa home address and explicitly directed cartel operatives to execute the beheading, according to U.S. Department of Justice documents. Handala Hack operates under Iran’s Ministry of Intelligence and Security, conducting cyber operations targeting regime critics worldwide. The identical threat targeted Iranian-American lawyer Elica Le Bon in Los Angeles, with hackers claiming they shared her address with CJNG partners for coordinated attacks.
DOJ Disrupts Terror Network Amid Canadian Inaction
U.S. authorities seized four Iranian government domains on March 19, 2026, disrupting infrastructure used for what DOJ officials termed “cyber-enabled psychological operations” calling for targeted killings. The seized domains—Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to—definitively link the hacker personas to MOIS operations. Federal investigators documented the sites’ use for coordinating threats, leaking stolen data from Jewish community organizations, and directing cartel violence against diaspora activists. This represents decisive American action while Canadian authorities filed a police report but offered Ghamari little more than reassurances, despite her warnings that Canada hosts approximately 700 Iranian regime operatives operating with alarming freedom.
Regime Desperation Targets Free Speech Advocates
Ghamari’s YouTube channel exposes Iranian regime atrocities, including public executions and torture of political prisoners, making her a priority target for Tehran’s transnational repression campaign. The threats emerged after she allegedly mocked reports of Supreme Leader Ali Khamenei’s death, triggering the coordinated bounty operation. Handala Hack previously targeted dissidents via email with cartel bounties, and a shooting occurred at another Iranian-Canadian activist’s gym days before Ghamari’s threat. The escalation follows Iran’s post-2022 protest crackdown, with MOIS weaponizing hackers for doxxing and intimidation campaigns. Ghamari describes the threats as “the regime’s final death throes activating sleeper cells,” while criticizing Canadian Prime Minister Mark Carney for dismissing security concerns about Iranian networks operating freely across the country.
Foreign Terror Threat Exploits Western Complacency
This operation exposes dangerous gaps in North American security as foreign adversaries exploit open borders and lax enforcement to threaten citizens exercising constitutional free speech rights. The MOIS-CJNG partnership demonstrates how state sponsors of terrorism outsource violence for plausible deniability, leveraging cartels’ established North American presence. Iranian operatives conduct operations from Canadian soil while American activists face coordinated threats at their homes, yet Western governments respond with inadequate urgency. The Anti-Defamation League documented coordinated Wikipedia edits smearing Ghamari, revealing sophisticated information warfare accompanying physical threats. While the Trump administration faces criticism over the Iran war, this incident underscores the regime’s aggression predates current conflicts and directly targets diaspora communities defending American values of freedom and human rights against authoritarian brutality.
Sources:
Iran-linked hackers offer $250K bounty on ex-politician – The Jerusalem Post
DOJ Seizes Iranian Intelligence Websites Behind Beheading Bounty on Canadian Politician – Todayville
More Than 700 Iran Agents in Canada Pose National Security Threat, MP Warns – Todayville













