Also known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm, Banished Kitten, Storm-0842, Void Manticore
Tracked asG1055CHOSEN BRICK
VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.
Iran-linked hacktivist persona assessed to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS)
Came into being shortly after October 7, 2023 armed attacks by Hamas targeting southern Israel
Has a history of conducting destructive wiping attacks and hack and leak operations
Attribution assessment
Facts
Handala Hack is assessed to be an online persona operated by Void Manticore, a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS)
Void Manticore is also known as Banished Kitten, Red Sandstorm, and Storm-0842
The U.K. National Cyber Security Center tracks HEAVYGRAM malware under the moniker CHOSEN BRICK
Initial access and identity targets
Facts
Social engineering via messaging platforms like Telegram, WhatsApp, and Instagram
Posing as technical support or trusted contacts
Delivering malware disguised as legitimate application installers
Capabilities and evasion
Facts
Remote command execution via Telegram C2
System, network and process information discovery
Data and Telegram session files exfiltration
Screenshot capture
DLL sideloading
File cleanup
Password theft from web browsers
Microphone activation
Copy Telegram and WhatsApp data
Download additional malware
File upload/download capabilities
Infrastructure patterns
Facts
Telegram-based command and control utilizing bots and groups
Two main C2 setups: one with single bot and group, another with separate bots for check-ins and logging
Uses natively encrypted Telegram channels with low setup and maintenance costs
Observed targeting
Facts
Targeted Iran International journalists in September 2025 hack and leak operation
Focus on Iranian dissidents, journalists opposed to Iran, and opposition groups
Objectives include intelligence collection, data leak, and reputational harm
Named victims
Organizations
Iran International journalists
Iranian dissidents
journalists opposed to Iran
opposition groups
Defender guidance
Facts
Monitor for Telegram bot communications as C2 channel
Watch for Microsoft Defender exclusion path modifications
Review Windows autorun Registry keys for malicious persistence
Be alert to social engineering via Telegram, WhatsApp, and Instagram
Reported detail
Facts
Handala Hack is assessed to be a persona of Void Manticore, an Iran-MOIS-affiliated threat actor that emerged after October 7, 2023
The group uses HEAVYGRAM, a Python-based Telegram backdoor capable of remote code execution, password theft, and data exfiltration first detected in September 2023
CRUDEEXCLUDE, a Delphi-based utility observed from July 2024, stages malware payloads and disables Microsoft Defender by setting exclusion paths
Attacks leverage social engineering through Telegram, WhatsApp, and Instagram, delivering malware disguised as legitimate applications like KeePass and Telegram
Victims include Iranian dissidents, journalists, and opposition figures targeted for intelligence collection and data leaks
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
Indicator4 indicators cataloged
Types: domain, tool.
Cataloged
IdentityAlias: Void Manticore
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Banished Kitten
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Red Sandstorm
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Storm-0842
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: CHOSEN BRICK
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: COBALT MYSTIQUE
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Handala Hack
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Homeland Justice
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Karma
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Karmabelow80
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: BANISHED KITTEN
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Red Sandstorm
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G1055
Reviewed identity mapping approved on this date.
Last observed
CampaignHomeLand Justice
HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. I…
First listed
Victim claimOur first post listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimSaurer. Part 1. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimAlign Technology. Part 1. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimThe next leak will be of a multi billion dollar cosmetics and fragrance company. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimAlign Technology. Part 2. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimSI Group. Part 1. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimYASH Technologies. Part 1. listed by VOID MANTICORE
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
VOID MANTICORECanonical Name
Handala HackCanonical Name
BANISHED KITTENAlias
COBALT MYSTIQUEAlias
Handala HackAlias
Homeland JusticeAlias
KarmaAlias
Karmabelow80Alias
Red SandstormAlias
Storm-0842Alias
Void ManticoreAlias
G1055Tracking Id
CHOSEN BRICKTracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...