Void Manticore — APT Profile
Void Manticore is an Iranian MOIS-linked APT conducting destructive wiper attacks against Israeli organizations. Leaks data via Karma persona. Extended operations to Albania as Homeland Justice. Uses custom wipers and web shells. Coordinates with Scarred Manticore for initial access.Also tracked as
Karma, Homeland Justice, Tremor Pulse, DEV-0842, Storm-0842, G1055, Red Sandstorm, BANISHED KITTEN
IntelFusions coverage (5)
- Public exploit code can take over vBulletin forums 2026-08-26 · Vulnerabilities
- From Hacktivist to State Proxy: How Handala Became Iran's Most Prominent Cyber Persona 2026-03-03 · Nation-State
- Handala Claims Saudi Aramco Breach Amid Escalating Iranian Cyber Operations 2026-03-03 · Cyber Incidents
- Operation Bibi Gate: Handala Breaches Telegram Accounts of Senior Israeli Officials 2026-02-16 · Nation-State
- Handala Deploys Wiper Malware Disguised as CrowdStrike Fix During Global Outage 2026-02-16 · Cyber Incidents
Tools & malware
- BiBi Wiper Wiper
- CHIMNEYSWEEP backdoor
- Cl Wiper Wiper
- Cl Wiper (cl.exe) wiper
- Custom Web Shells Webshell
- Karma Shell web-shell
- Mimikatz credential-theft
- No-Justice (NACL.exe / LowEraser) wiper
- No-Justice Wiper Wiper
- Plink tunneling-utility
- RawDisk driver
- RevSocks tunneling-utility
- ROADSWEEP (GoXml.exe) ransomware
- ZeroCleare wiper
Vendor research
- Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware The Hacker News
- Wiper malware found in analysis of Iran-linked attacks on Albanian institutions The Record (Recorded Future News)
- Iranian State Actors Conduct Cyber Operations Against the Government of Albania (Alert AA22-264A) CISA / FBI
- Microsoft investigates Iranian attacks against the Albanian government Microsoft
- Void Manticore (G1055) MITRE ATT&CK
- Iran COBALT MYSTIQUE Sophos
- “Handala Hack” – Unveiling Group’s Modus Operandi Check Point Research
- Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to DOJ/FBI
- Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment DomainTools Investigations
- Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization Justin Moore
- Bad Karma, No Justice: Void Manticore Destructive Activities Check Point
- Iranian Threat Group Conducts Destructive Attacks Against Israeli Organizations Unit 42