VOID MANTICORE

Origen🇮🇷 Irã

Técnicas (MITRE ATT&CK)63

FuenteMITRE ATT&CK

También conocido como:BANISHED KITTENCOBALT MYSTIQUEHandala HackHomeland JusticeKarmaKarmabelow80Red Sandstorm

Sobre el grupo

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal83

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 63

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Reconocimiento

Gather Victim Identity Information Vulnerability Scanning

Preparación de recursos

Domains Virtual Private Server Server Web Services Social Media Accounts Email Accounts Malware Malware Tool

Acceso inicial

Exploit Public-Facing Application Trusted Relationship Phishing

Ejecución

Windows Management Instrumentation PowerShell Python Software Deployment Tools Malicious File Cloud Administration Command

Persistencia

Account Manipulation External Remote Services Registry Run Keys / Startup Folder

Acceso a credenciales

LSASS Memory Brute Force Password Guessing Credential Stuffing Credentials in Registry

Descubrimiento

System Information Discovery Domain Account

Movimiento lateral

Remote Desktop Protocol

Recolección

Data from Local System Data Staged Screen Capture Remote Email Collection Automated Collection Audio Capture Video Capture Sharepoint Archive via Utility

Comando y control

Web Protocols Web Service Ingress Tool Transfer Remote Desktop Software Protocol Tunneling

Exfiltración

Exfiltration Over C2 Channel

Impacto

Data Destruction Data Encrypted for Impact Inhibit System Recovery Disk Content Wipe Disk Structure Wipe Financial Theft

defense-impairment

Group Policy Modification Windows Host Firewall

stealth

Compression Masquerade Task or Service Match Legitimate Resource Name or Location Valid Accounts Domain Accounts Cloud Accounts Hidden Window Selective Exclusion Impersonation

Vulnerabilidades explotadas 3

CVEs que este grupo es conocido por explotar, según MITRE ATT&CK. Ordenadas por gravedad real.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2019-0604CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

Referencias

research.checkpoint.com ↗

El grupo VOID MANTICORE usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →