VOID MANTICORE
VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack,…
- ATT&CK ID
- G1055
- Origin
- Iran
- Weather family
- Sandstorm
- Techniques
- 51
- Tools
- 0
Also tracked as COBALT MYSTIQUE · Handala Hack · Homeland Justice · Karma · Karmabelow80 · BANISHED KITTEN · Red Sandstorm
Vulnerabilities it has exploited
Techniques
Reconnaissance
Gather Victim Identity InformationActive Scanning
Resource Development
Acquire InfrastructureEstablish AccountsDevelop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesExploit Public-Facing ApplicationTrusted RelationshipPhishing
Execution
Windows Management InstrumentationCommand and Scripting InterpreterSoftware Deployment ToolsUser ExecutionCloud Administration Command
Persistence
Valid AccountsAccount ManipulationExternal Remote ServicesBoot or Logon Autostart Execution
Privilege Escalation
Valid AccountsAccount ManipulationDomain or Tenant Policy ModificationBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingValid AccountsHide ArtifactsSelective ExclusionSocial Engineering
Defense Impairment
Domain or Tenant Policy ModificationDisable or Modify System Firewall
Credential Access
OS Credential DumpingBrute ForceUnsecured Credentials
Discovery
System Information DiscoveryAccount Discovery
Lateral Movement
Remote ServicesSoftware Deployment Tools
Collection
Data from Local SystemData StagedScreen CaptureEmail CollectionAutomated CollectionAudio CaptureVideo CaptureData from Information RepositoriesArchive Collected Data
Command and Control
Application Layer ProtocolWeb ServiceIngress Tool TransferRemote Access ToolsProtocol Tunneling
Exfiltration
Impact
Data DestructionData Encrypted for ImpactInhibit System RecoveryDisk WipeFinancial Theft