自动化接入 · API / MCP EN

组织档案 · G1055

VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

ATT&CK G1055 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2026

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).1 Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.23 VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.45 VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.6

  1. Check Point VOID MANTICORE Handala Hack March 2026
  2. Check Point VOID MANTICORE Handala Hack March 2026
  3. Palo Alto VOID MANTICORE Iran Cyber Threats March 2026
  4. Check Point VOID MANTICORE Handala Hack March 2026
  5. DOJ FBI Handala Hack March 2026
  6. Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asVOID MANTICORE— → …100src_mitre_attck_enterprise
also_known_asCOBALT MYSTIQUE— → …100src_mitre_attck_enterprise
also_known_asHandala Hack— → …100src_mitre_attck_enterprise
also_known_asHomeland Justice— → …100src_mitre_attck_enterprise
also_known_asKarma— → …100src_mitre_attck_enterprise
also_known_asKarmabelow80— → …100src_mitre_attck_enterprise
also_known_asBANISHED KITTEN— → …100src_mitre_attck_enterprise
also_known_asRed Sandstorm— → …100src_mitre_attck_enterprise
uses_techniquetech_t11132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11192026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1561.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15662026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15892026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1484.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11232026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10742026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0152026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16792026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10722026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16512026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1686.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1213.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1595.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1561.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10982026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11252026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15722026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11992026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1110.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11102026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012026 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1003.001LSASS Memory—
T1005Data from Local System—
T1021.001Remote Desktop Protocol—
T1027.015Compression—
T1036.004Masquerade Task or Service—
T1036.005Match Legitimate Resource Name or Location—
T1041Exfiltration Over C2 Channel—
T1047Windows Management Instrumentation—
T1059.001PowerShell—
T1059.006Python—
T1071.001Web Protocols—
T1072Software Deployment Tools—
T1074Data Staged—
T1078Valid Accounts—
T1078.002Domain Accounts—
T1078.004Cloud Accounts—
T1082System Information Discovery—
T1087.002Domain Account—
T1098Account Manipulation—
T1102Web Service—
T1105Ingress Tool Transfer—
T1110Brute Force—
T1110.001Password Guessing—
T1110.004Credential Stuffing—
T1113Screen Capture—
T1114.002Remote Email Collection—
T1119Automated Collection—
T1123Audio Capture—
T1125Video Capture—
T1133External Remote Services—
T1190Exploit Public-Facing Application—
T1199Trusted Relationship—
T1204.002Malicious File—
T1213.002Sharepoint—
T1219.002Remote Desktop Software—
T1484.001Group Policy Modification—
T1485Data Destruction—
T1486Data Encrypted for Impact—
T1490Inhibit System Recovery—
T1547.001Registry Run Keys / Startup Folder—
T1552.002Credentials in Registry—
T1560.001Archive via Utility—
T1561.001Disk Content Wipe—
T1561.002Disk Structure Wipe—
T1564.003Hidden Window—
T1566Phishing—
T1572Protocol Tunneling—
T1583.001Domains—
T1583.003Virtual Private Server—
T1583.004Server—
T1583.006Web Services—
T1585.001Social Media Accounts—
T1585.002Email Accounts—
T1587.001Malware—
T1588.001Malware—
T1588.002Tool—
T1589Gather Victim Identity Information—
T1595.002Vulnerability Scanning—
T1651Cloud Administration Command—
T1657Financial Theft—
T1679Selective Exclusion—
T1684.001Impersonation—
T1686.003Windows Host Firewall—

别名

BANISHED KITTEN · COBALT MYSTIQUE · Handala Hack · Homeland Justice · Karma · Karmabelow80 · Red Sandstorm · VOID MANTICORE

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错