Void Manticore

Introduction

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Check Point VOID MANTICORE Handala Hack March 2026 Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. Check Point VOID MANTICORE Handala Hack March 2026 Palo Alto VOID MANTICORE Iran Cyber Threats March 2026 VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. Check Point VOID MANTICORE Handala Hack March 2026 DOJ FBI Handala Hack March 2026 VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity. Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Notable Campaigns

• HomeLand Justice (C0038): HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was

Tactics, Techniques, and Procedures (TTPs)

• T1113 Screen Capture
• T1110.001 Password Guessing
• T1119 Automated Collection
• T1561.001 Disk Content Wipe
• T1486 Data Encrypted for Impact
• T1566 Phishing
• T1589 Gather Victim Identity Information
• T1657 Financial Theft
• T1102 Web Service
• T1059.001 PowerShell
• T1047 Windows Management Instrumentation
• T1484.001 Group Policy Modification
• T1564.003 Hidden Window
• T1583.001 Domains
• T1123 Audio Capture
• T1190 Exploit Public-Facing Application
• T1114.002 Remote Email Collection
• T1074 Data Staged
• T1078.002 Domain Accounts
• T1027.015 Compression
• T1684.001 Impersonation
• T1036.005 Match Legitimate Resource Name or Location
• T1679 Selective Exclusion
• T1087.002 Domain Account
• T1588.001 Malware
• T1490 Inhibit System Recovery
• T1072 Software Deployment Tools
• T1003.001 LSASS Memory
• T1651 Cloud Administration Command
• T1583.003 Virtual Private Server
• T1583.006 Web Services
• T1686.003 Windows Host Firewall
• T1552.002 Credentials in Registry
• T1213.002 Sharepoint
• T1219.002 Remote Desktop Software
• T1595.002 Vulnerability Scanning
• T1561.002 Disk Structure Wipe
• T1583.004 Server
• T1105 Ingress Tool Transfer
• T1082 System Information Discovery
• T1078.004 Cloud Accounts
• T1133 External Remote Services
• T1588.002 Tool
• T1547.001 Registry Run Keys / Startup Folder
• T1204.002 Malicious File
• T1005 Data from Local System
• T1098 Account Manipulation
• T1125 Video Capture
• T1572 Protocol Tunneling
• T1587.001 Malware
• T1585.002 Email Accounts
• T1071.001 Web Protocols
• T1199 Trusted Relationship
• T1110.004 Credential Stuffing
• T1585.001 Social Media Accounts
• T1485 Data Destruction
• T1078 Valid Accounts
• T1110 Brute Force
• T1036.004 Masquerade Task or Service
• T1059.006 Python
• T1560.001 Archive via Utility
• T1041 Exfiltration Over C2 Channel
• T1021.001 Remote Desktop Protocol

ATT&CK technique IDs (denormalized)

• T1003.001
• T1005
• T1021.001
• T1027.015
• T1036.004
• T1036.005
• T1041
• T1047
• T1059.001
• T1059.006
• T1071.001
• T1072
• T1074
• T1078
• T1078.002
• T1078.004
• T1082
• T1087.002
• T1098
• T1102
• T1105
• T1110
• T1110.001
• T1110.004
• T1113
• T1114.002
• T1119
• T1123
• T1125
• T1133
• T1190
• T1199
• T1204.002
• T1213.002
• T1219.002
• T1484.001
• T1485
• T1486
• T1490
• T1547.001
• T1552.002
• T1560.001
• T1561.001
• T1561.002
• T1564.003
• T1566
• T1572
• T1583.001
• T1583.003
• T1583.004
• T1583.006
• T1585.001
• T1585.002
• T1587.001
• T1588.001
• T1588.002
• T1589
• T1595.002
• T1651
• T1657
• T1679
• T1684.001
• T1686.003

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• Wiper

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [9] Check Point VOID MANTICORE Handala Hack March 2026 Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026. [10] DOJ FBI Handala Hack March 2026 DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026. [11] Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026 DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026. [12] Palo Alto VOID MANTICORE Iran Cyber Threats March 2026 Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026. [13] Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026 Sophos. (2026, April 20). Iran COBALT MYSTIQUE. Retrieved April 20, 2026.