Cyber Resilience

Threat actor · all actors

VOID MANTICOREG1055 state

🇮🇷 IR

aka VOID MANTICORE, COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm, DUNE, Storm-0842

Last updated: 2026-08-20

0attributed CVEs
87ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active

About this actor

[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including (LinkByld: C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1055

Microsoftweather-system names

Red SandstormStorm-0842

CrowdStrikenation-animal names

BANISHED KITTEN

Secureworkscolour-metal names

COBALT MYSTIQUE

Unclassifiedno scheme matched

VOID MANTICOREHandala HackHomeland JusticeKarmaKarmabelow80DUNE

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 87 ATT&CK techniques on file.
Named victims
2 extracted from reporting.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVERiskCVSSEPSSPublishedProducts
No attributed CVEs.

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-452 / 8760%
CM-643 / 8749%
CM-242 / 8748%
AC-341 / 8747%
AC-637 / 8743%
CM-733 / 8738%
SI-331 / 8736%
AC-230 / 8734%
SI-728 / 8732%
CA-727 / 8731%
IA-226 / 8730%
AC-424 / 8728%
AC-523 / 8726%
SC-721 / 8724%
CM-520 / 8723%

Co-occurring actors

None.

Similar actors

Similar TTPs

Same nation-state

Same category