Início / Grupos de ameaça / VOID MANTICORE

VOID MANTICORE G1055

🔔 Criar alerta

Também conhecido como: COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

77

Técnicas

0

Malwares e ferramentas

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

Operações de ransomware ligadas a este grupo ransomware.live

karma

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2019-0604 Crítica · 9.8 KEV Ransomware Microsoft SharePoint Remote Code Execution Vulnerability

“VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.”

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1595.002 Vulnerability Scanning

Desenvolvimento de recursos

T1583.001 Domains T1583.003 Virtual Private Server T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1585.002 Email Accounts T1587.001 Malware T1588.001 Malware T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566 Phishing

Execução

T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.006 Python T1072 Software Deployment Tools T1204.002 Malicious File T1651 Cloud Administration Command

Persistência

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1133 External Remote Services T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1484.001 Group Policy Modification T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027.015 Compression T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1564.003 Hidden Window T1679 Selective Exclusion T1684.001 Impersonation

Comprometimento de defesas

T1484.001 Group Policy Modification T1686.003 Windows Host Firewall

Acesso a credenciais

T1003.001 LSASS Memory T1110 Brute Force T1110.001 Password Guessing T1110.004 Credential Stuffing T1552.002 Credentials in Registry

Descoberta

T1082 System Information Discovery T1087.002 Domain Account

Movimento lateral

T1021.001 Remote Desktop Protocol T1072 Software Deployment Tools

Coleta

T1005 Data from Local System T1074 Data Staged T1113 Screen Capture T1114.002 Remote Email Collection T1119 Automated Collection T1123 Audio Capture T1125 Video Capture T1213.002 Sharepoint T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1102 Web Service T1105 Ingress Tool Transfer T1219.002 Remote Desktop Software T1572 Protocol Tunneling

Exfiltração

T1041 Exfiltration Over C2 Channel

Impacto

T1485 Data Destruction T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe T1657 Financial Theft

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.