Void Manticore

Also known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm

1mentions, 7 days

2mentions, 30 days

Nov 5, 2026last mentioned

Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using custom wipers. Void Manticore's TTPs involve manual file deletion, lateral movement via RDP, and the deployment of custom wipers like the BiBi wiper. The group utilizes online personas like 'Karma' and 'Homeland Justice' to leak information and amplify the impact of their attacks.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1005 Data from Local System T1021.001 Remote Desktop Protocol T1027.015 Compression T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1041 Exfiltration Over C2 Channel T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.006 Python T1071.001 Web Protocols T1072 Software Deployment Tools T1074 Data Staged T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1082 System Information Discovery T1087.002 Domain Account T1098 Account Manipulation T1102 Web Service T1105 Ingress Tool Transfer T1110 Brute Force T1110.001 Password Guessing T1110.004 Credential Stuffing T1113 Screen Capture T1114.002 Remote Email Collection T1119 Automated Collection T1123 Audio Capture T1125 Video Capture T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1204.002 Malicious File T1213.002 Sharepoint T1219.002 Remote Desktop Software T1484.001 Group Policy Modification T1485 Data Destruction T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1547.001 Registry Run Keys / Startup Folder T1552.002 Credentials in Registry T1560.001 Archive via Utility T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe T1564.003 Hidden Window T1566 Phishing T1572 Protocol Tunneling T1583.001 Domains T1583.003 Virtual Private Server T1583.004 Server T1583.006 Web Services T1585.001 Social Media Accounts T1585.002 Email Accounts T1587.001 Malware T1588.001 Malware T1588.002 Tool T1589 Gather Victim Identity Information T1595.002 Vulnerability Scanning T1651 Cloud Administration Command T1657 Financial Theft T1679 Selective Exclusion T1684.001 Impersonation T1686.003 Windows Host Firewall

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.