Automation · API / MCP 中文

Group profile · G1055

VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

ATT&CK G1055 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2026

Showing 2026 citations only; facet pages stay out of the index and canonicalise to the profile.

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).1 Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.23 VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.45 VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.6

  1. Check Point VOID MANTICORE Handala Hack March 2026
  2. Check Point VOID MANTICORE Handala Hack March 2026
  3. Palo Alto VOID MANTICORE Iran Cyber Threats March 2026
  4. Check Point VOID MANTICORE Handala Hack March 2026
  5. DOJ FBI Handala Hack March 2026
  6. Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
uses_techniquetech_t11132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11192026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1561.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15662026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15892026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1484.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11232026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10742026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0152026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16792026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10722026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16512026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1686.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1213.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1595.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1561.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10982026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11252026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15722026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11992026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11102026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012026 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1003.001LSASS Memory—
T1005Data from Local System—
T1021.001Remote Desktop Protocol—
T1027.015Compression—
T1036.004Masquerade Task or Service—
T1036.005Match Legitimate Resource Name or Location—
T1041Exfiltration Over C2 Channel—
T1047Windows Management Instrumentation—
T1059.001PowerShell—
T1059.006Python—
T1071.001Web Protocols—
T1072Software Deployment Tools—
T1074Data Staged—
T1078Valid Accounts—
T1078.002Domain Accounts—
T1078.004Cloud Accounts—
T1082System Information Discovery—
T1087.002Domain Account—
T1098Account Manipulation—
T1102Web Service—
T1105Ingress Tool Transfer—
T1110Brute Force—
T1110.001Password Guessing—
T1110.004Credential Stuffing—
T1113Screen Capture—
T1114.002Remote Email Collection—
T1119Automated Collection—
T1123Audio Capture—
T1125Video Capture—
T1133External Remote Services—
T1190Exploit Public-Facing Application—
T1199Trusted Relationship—
T1204.002Malicious File—
T1213.002Sharepoint—
T1219.002Remote Desktop Software—
T1484.001Group Policy Modification—
T1485Data Destruction—
T1486Data Encrypted for Impact—
T1490Inhibit System Recovery—
T1547.001Registry Run Keys / Startup Folder—
T1552.002Credentials in Registry—
T1560.001Archive via Utility—
T1561.001Disk Content Wipe—
T1561.002Disk Structure Wipe—
T1564.003Hidden Window—
T1566Phishing—
T1572Protocol Tunneling—
T1583.001Domains—
T1583.003Virtual Private Server—
T1583.004Server—
T1583.006Web Services—
T1585.001Social Media Accounts—
T1585.002Email Accounts—
T1587.001Malware—
T1588.001Malware—
T1588.002Tool—
T1589Gather Victim Identity Information—
T1595.002Vulnerability Scanning—
T1651Cloud Administration Command—
T1657Financial Theft—
T1679Selective Exclusion—
T1684.001Impersonation—
T1686.003Windows Host Firewall—

Aliases

BANISHED KITTEN · COBALT MYSTIQUE · Handala Hack · Homeland Justice · Karma · Karmabelow80 · Red Sandstorm · VOID MANTICORE

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections