Search threats, CVEs… ⌘K
← Back to all threat actors

VOID MANTICORE

Also known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm
Tracked as G1055

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.

How we source and review actor profiles
Sectors
manufacturing, retail-e-commerce, technology
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
IdentityAlias: COBALT MYSTIQUE

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Handala Hack

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Homeland Justice

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Karma

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Karmabelow80

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: BANISHED KITTEN

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Red Sandstorm

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G1055

Reviewed identity mapping approved on this date.

Last observed
CampaignHomeLand Justice

HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. I…

First listed
Victim claimOur first post listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSaurer. Part 1. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAlign Technology. Part 1. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe next leak will be of a multi billion dollar cosmetics and fragrance company. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAlign Technology. Part 2. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSI Group. Part 1. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimYASH Technologies. Part 1. listed by VOID MANTICORE

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

VOID MANTICORECanonical Name
BANISHED KITTENAlias
COBALT MYSTIQUEAlias
Handala HackAlias
Homeland JusticeAlias
KarmaAlias
Karmabelow80Alias
Red SandstormAlias
G1055Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...