Void ManticoreThreat actor
- banished kitten
- cobalt mystique
- dune
- Handala Hack
- Homeland Justice
- karmabelow80
- red sandstorm
- storm-0842
Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using custom wipers. Void Manticore's TTPs involve manual file deletion, lateral movement via RDP, and the deployment of custom wipers like the BiBi wiper.From MISP Galaxy
Last reported 27 days ago, by CERT-EU6 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
- T1195Supply Chain Compromise
“A compromised supplier may expose customer identities and trusted administrative paths, but it’s only a software supply-chain compromise if there is evidence that downstream customers, builds, updates, or distribution were affected.”
- T1036Masquerading
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1213.005Messaging Applications
“Victims were contacted via messaging applications, where they received the first stage of the malware – masquerading as a legitimate program.”
- T1219.002Remote Desktop Software
“…g RuntimeSSH.exe – a second-stage of Heavygram, masquerading as a PowerShell program, and winappx.exe – masquerading as Windows remote desktop software.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Cyber Brief 26-04 - March 2026“…her with the US, dismantled the SocksEscort proxy service, and the US Federal Bureau of Investigation (FBI) took down the Iran-linked Handala Hack Team leak site.”
-
The Flashpoint Threat Intelligence Brief: Middle East“Security researchers identified HEAVYGRAM, a backdoor attributed with moderate confidence to the Iran-linked group “Handala Hack.” The malware leverages the Telegram API to blend C2 communications with legitimate user traffic, performing remote surveillance and data exfiltration…”
-
Risky Bulletin: Gemini hacked three companies too“Handala's HEAVYGRAM: A new report looks at HEAVYGRAM, a Telegram-based Windows backdoor used by the Handala Hack Iranian group since the fall of 2023.”
-
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack“HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack”
-
The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact“These pro-Russian hacktivist groups, such as NoName057 and Killnet, alongside pro-Iranian collectives and proxy ecosystems like Handala Hack, often react to the news cycle and target countries designated by state media or ideological narratives as enemies.”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“MOIS-linked personas such as Handala, Homeland Justice, and Karma combine intrusion, destruction, disclosure, and coercion.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- justicehomeland[.]orgin 1 report
- karmabelow80[.]orgin 1 report
- handala-redwanted[.]toin 1 report
- handala-hack[.]toin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/in 1 report
- sgp1.vultrobjects[.]comin 1 report
- hxxps://sgp1.vultrobjects[.]com/jttrepijgdb/efg_d4.zipin 1 report
- hxxps://api.telegram[.]org/bot783XXXX576in 1 report
- hxxps://api.telegram[.]org/bot772XXXX818in 1 report
- hxxps://api.telegram[.]org/file/in 1 report
- 8219453084f370ce…d82d617f26ddin 1 report
- 0190940243f6535f…43d493159e14in 1 report
- b3c1a3eebefafe1346c6a864b5423182in 1 report
- 47fa634b13b8ba35…68f848825de4in 1 report
- 88a8d118ee190ac3…6ddd2dda517bin 1 report
- b2f6f40570ac9085b5463fdb623560dein 1 report
- d2d19c7f2e4a5fdc…df32307c377ein 1 report
- 9108466c98df0103…0c23372c52f2in 1 report
- 16602375fc2dae1eb54580ab7eda6567in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.