MITRE ATT&CKgroup
G1055 VOID MANTICORE
- Domain
- enterprise
- Aliases
- COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm
- Version
- 1.0
- Created
- 2026-04-20
Description
VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.
Related
Uses · MITRE ATT&CK (63)
- T1684.001 Impersonation sub-technique
- T1686.003 Windows Host Firewall sub-technique
- T1679 Selective Exclusion technique
- T1219.002 Remote Desktop Software sub-technique
- T1027.015 Compression sub-technique
- T1657 Financial Theft technique
- T1651 Cloud Administration Command technique
- T1484.001 Group Policy Modification sub-technique
- T1589 Gather Victim Identity Information technique
- T1595.002 Vulnerability Scanning sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1583.004 Server sub-technique
- T1583.006 Web Services sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1587.001 Malware sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1572 Protocol Tunneling technique
- T1078.002 Domain Accounts sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1564.003 Hidden Window sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.006 Python sub-technique
- T1566 Phishing technique
- T1087.002 Domain Account sub-technique
- T1560.001 Archive via Utility sub-technique
Referenced by MITRE ATT&CK · attributed to (1)
- C0038 HomeLand Justice campaign
References
- https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/ Check Point VOID MANTICORE Handala Hack March 2026
- https://www.justice.gov/opa/media/1431956/dl?inline DOJ FBI Handala Hack March 2026
- https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026
- https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/ Palo Alto VOID MANTICORE Iran Cyber Threats March 2026
- https://www.sophos.com/en-us/threat-profiles/cobalt-mystique Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026