VOID MANTICORE

Overview

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

Naming & attribution

VOID MANTICORE is tracked under 8 names across the industry. It uses 63 documented ATT&CK techniques — more than 90% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1679 Selective Exclusion — used by 1 of 174 groups
• T1110.004 Credential Stuffing — used by 2 of 174 groups
• T1123 Audio Capture — used by 2 of 174 groups
• T1651 Cloud Administration Command — used by 2 of 174 groups
• T1110.001 Password Guessing — used by 3 of 174 groups
• T1552.002 Credentials in Registry — used by 3 of 174 groups
• T1561.001 Disk Content Wipe — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Magic Hound Iran — 28 shared techniques (25% overlap)
• Sandworm Team Russia — 28 shared techniques (25% overlap)
• APT28 Russia — 27 shared techniques (21% overlap)
• Scattered Spider — 22 shared techniques (21% overlap)
• FIN13 — 20 shared techniques (21% overlap)
• Ke3chang China — 19 shared techniques (21% overlap)

Targets

Civil society · Education · Government · Healthcare · High-Tech · Media · NGOs · Pharmaceuticals · Telecommunications

Regions

Europe · Israel · Middle East · United States

Capabilities

• Destructive / data-wiping operations — ATT&CK T1485, T1561.001, T1561.002
• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 63 techniques across 14 tactics

Reporting (3)

• Iran COBALT MYSTIQUE — Sophos
• Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment — DomainTools Investigations
• Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to — DOJ/FBI