Threat intelligence / Group

VOID MANTICORE

[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)

64 recorded

Relationships

attributed-to

from HomeLand Justice

Campaign

uses

to Account Manipulation

Technique

uses

to Archive via Utility

Technique

uses

to Audio Capture

Technique

uses

to Automated Collection

Technique

uses

Technique

uses

to Cloud Accounts

Technique

uses

to Cloud Administration Command

Technique

uses

Technique

uses

to Credentials in Registry

Technique

uses

to Credential Stuffing

Technique

uses

to Data Destruction

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Local System

Technique

uses

Technique

uses

to Disk Content Wipe

Technique

uses

to Disk Structure Wipe

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

Technique

uses

to Email Accounts

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to Financial Theft

Technique

uses

to Gather Victim Identity Information

Technique

uses

to Group Policy Modification

Technique

uses

to Hidden Window

Technique

uses

to Impersonation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

Technique

uses

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Password Guessing

Technique

uses

Technique

uses

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote Desktop Software

Technique

uses

to Remote Email Collection

Technique

uses

to Screen Capture

Technique

uses

to Selective Exclusion

Technique

uses

Technique

uses

Technique

uses

to Social Media Accounts

Technique

uses

to Software Deployment Tools

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

to Trusted Relationship

Technique

uses

to Valid Accounts

Technique

uses

to Video Capture

Technique

uses

to Virtual Private Server

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Web Services

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

13 external

References

mitre-attack

G1055

BANISHED KITTEN

—

Red Sandstorm

—

Handala Hack

—

Homeland Justice

—

Karma

—

COBALT MYSTIQUE

—

Karmabelow80

—

Check Point VOID MANTICORE Handala Hack March 2026

https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/

DOJ FBI Handala Hack March 2026

https://www.justice.gov/opa/media/1431956/dl?inline

Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment

Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/

Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026

https://www.sophos.com/en-us/threat-profiles/cobalt-mystique