Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Void Manticore · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Void Manticore

  • COBALT MYSTIQUE
  • Handala Hack
  • Homeland Justice
  • Karma
  • Karmabelow80
  • BANISHED KITTEN
  • Red Sandstorm

MITRE G1055 ↗

Void Manticore — ATT&CK roseVM

attack rose · 63 techniques across 14 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2019-0604
  2. —29 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using custom wipers. Void Manticore's TTPs involve manual file deletion, lateral movement via RDP, and the deployment of custom wipers like the BiBi wiper. The group utilizes online personas like 'Karma' and 'Homeland Justice' to leak information and amplify the impact of their attacks.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

63 techniques · 14 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    9 techniques

  3. Initial access

    3 techniques

  4. Execution

    6 techniques

  5. Persistence

    3 techniques

  6. Stealth

    9 techniques

  7. Defense impairment

    2 techniques

  8. Credential access

    5 techniques

  9. Discovery

    2 techniques

  10. Lateral movement

    1 technique

  11. Collection

    9 techniques

  12. Command and control

    5 techniques

  13. Exfiltration

    1 technique

  14. Impact

    6 techniques

select a technique

CVEs Void Manticore is cited as exploiting

1 on CISA KEV
  1. CVE-2019-0604KEV2026-10-17
    1. “VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

7 sources
  1. 1.research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-a…
  2. 2.attack.mitre.org/groups/G1055
  3. 3.research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi
  4. 4.justice.gov/opa/media/1431956/dl?inline
  5. 5.dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem…
  6. 6.unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats
  7. 7.sophos.com/en-us/threat-profiles/cobalt-mystique

Track Void Manticore on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.