Home / Threat actors / VOID MANTICORE

VOID MANTICORE G1055

🔔 Create alert

Also known as: COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

77

Techniques

0

Malware and tools

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

Ransomware operations linked to this group ransomware.live

karma

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2019-0604 Critical · 9.8 KEV Ransomware Microsoft SharePoint Remote Code Execution Vulnerability

“VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.”

Techniques by tactic

Reconnaissance

T1589 Gather Victim Identity Information T1595.002 Vulnerability Scanning

Resource Development

T1583.001 Domains T1583.003 Virtual Private Server T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1585.002 Email Accounts T1587.001 Malware T1588.001 Malware T1588.002 Tool

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566 Phishing

Execution

T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.006 Python T1072 Software Deployment Tools T1204.002 Malicious File T1651 Cloud Administration Command

Persistence

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1133 External Remote Services T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1484.001 Group Policy Modification T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.015 Compression T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1564.003 Hidden Window T1679 Selective Exclusion T1684.001 Impersonation

Defense Impairment

T1484.001 Group Policy Modification T1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS Memory T1110 Brute Force T1110.001 Password Guessing T1110.004 Credential Stuffing T1552.002 Credentials in Registry

Discovery

T1082 System Information Discovery T1087.002 Domain Account

Lateral Movement

T1021.001 Remote Desktop Protocol T1072 Software Deployment Tools

Collection

T1005 Data from Local System T1074 Data Staged T1113 Screen Capture T1114.002 Remote Email Collection T1119 Automated Collection T1123 Audio Capture T1125 Video Capture T1213.002 Sharepoint T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1102 Web Service T1105 Ingress Tool Transfer T1219.002 Remote Desktop Software T1572 Protocol Tunneling

Exfiltration

T1041 Exfiltration Over C2 Channel

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe T1657 Financial Theft

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.