VOID MANTICORE

Origin🇮🇷 Irã

Techniques (MITRE ATT&CK)63

SourceMITRE ATT&CK

Also known as:BANISHED KITTENCOBALT MYSTIQUEHandala HackHomeland JusticeKarmaKarmabelow80Red Sandstorm

About the group

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity83

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 63

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Vulnerability Scanning

Resource development

Domains Virtual Private Server Server Web Services Social Media Accounts Email Accounts Malware Malware Tool

Initial access

Exploit Public-Facing Application Trusted Relationship Phishing

Execution

Windows Management Instrumentation PowerShell Python Software Deployment Tools Malicious File Cloud Administration Command

Persistence

Account Manipulation External Remote Services Registry Run Keys / Startup Folder

Credential access

LSASS Memory Brute Force Password Guessing Credential Stuffing Credentials in Registry

Discovery

System Information Discovery Domain Account

Lateral movement

Remote Desktop Protocol

Collection

Data from Local System Data Staged Screen Capture Remote Email Collection Automated Collection Audio Capture Video Capture Sharepoint Archive via Utility

Command and control

Web Protocols Web Service Ingress Tool Transfer Remote Desktop Software Protocol Tunneling

Exfiltration

Exfiltration Over C2 Channel

Impact

Data Destruction Data Encrypted for Impact Inhibit System Recovery Disk Content Wipe Disk Structure Wipe Financial Theft

defense-impairment

Group Policy Modification Windows Host Firewall

stealth

Compression Masquerade Task or Service Match Legitimate Resource Name or Location Valid Accounts Domain Accounts Cloud Accounts Hidden Window Selective Exclusion Impersonation

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2019-0604CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

research.checkpoint.com ↗

VOID MANTICORE uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →