IranAttributedMOISDestructiveActive 2021 – 2026VOID MANTICORE
Also known asHandala · Void Manticore · Storm-0842 · Red Sandstorm · Banished Kitten · COBALT MYSTIQUE · Handala Hack · Homeland Justice · Karmabelow80
Summary
Iranian destructive and hack-and-leak group that MITRE assesses operates on behalf of the MOIS (G1055); the US Justice Department seized Handala, Homeland Justice and Karma domains it says were used by the MOIS. Microsoft tracks it as Storm-0842 (Red Sandstorm). Its personas include Homeland Justice for attacks in Albania and Karma for attacks in Israel (Check Point, 2024), and Handala Hack, its current primary persona (MITRE). Check Point ties it to the March 2026 destructive attack on the US medical-technology firm Stryker, for which the MOIS claimed credit through the Handala Hack domain (DOJ); MITRE records that it used a privileged account in Microsoft Intune to issue built-in remote-wipe commands. Since Iran's January 2026 internet shutdown, Check Point has observed its activity from Starlink IP ranges.
Attribution
Ministry of Intelligence and Security
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Department of Justice (Government, 2026-03-19)
Seized Handala and Homeland Justice domains used by the MOIS - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Assessed to operate on behalf of the MOIS - Check Point Research (Research, 2026-03-12)
Operates the Handala Hack persona
Campaigns 8
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| California Water Service intrusion claimCLAIMED | 2026-06 | USA | Water/Wastewater | SentinelLabs (2026-07-21) |
| Handala doxxing of US forces and physical-sabotage solicitation (HPRF / MOISIRAN personas)CLAIMED | 2026-04 | USA, Israel, Middle East | Military, Government | Recorded Future (2026-06-02) |
| Handala-claimed breaches of Dubai government bodies (Courts, Land Department, RTA) — unverifiedCLAIMED | 2026-04 | UAE | Government, Transportation | bne IntelliNews (2026-04-12) reporting Handala's own statement — "The claims could not be independently verified." |
| Stryker destructive attack | 2026-03 | USA, Global | Healthcare, Medical Technology | Check Point Research (2026-03-12); US DOJ (2026-03-19) |
| Israeli energy/healthcare and Jordan fuel-system claimsCLAIMED | 2026-02 – 2026-03 | Israel, Jordan | Energy, Healthcare, Fuel Management | Unit 42 (2026-04-17), persona claims |
| Handala / Homeland Justice / Karma leak-and-doxxing sites (seized by DOJ 2026-03-19) | 2023 – 2026-03 | Israel, USA, Albania | Government, Defense, Media, Civil Society | US DOJ (2026-03-19) |
| HEAVYGRAM Telegram-C2 backdoor against Iranian dissidents and Farsi-language journalistsASSESSED | 2023 – 2025 | UK, USA, Iranian diaspora | Media, Civil Society | Group-IB (2026-09-17), citing FBI FLASH (2026-03-20) |
| HomeLand Justice — Albanian government ransomware, wiper and leak operation (MITRE C0038) | 2021-05 – 2022-09 | Albania | Government | MITRE C0038; CISA/FBI AA22-264A; Microsoft (2022-09-08) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 12
| Execution2 | T1072Software Deployment ToolsT1651Cloud Administration Command |
|---|---|
| Persistence2 | T1078.004Cloud AccountsT1133External Remote Services |
| Stealth1 | T1679Selective Exclusion |
| Defense Impairment1 | T1484.001Group Policy Modification |
| Credential Access3 | T1110.004Credential StuffingT1110.001Password GuessingT1552.002Credentials in Registry |
| Collection1 | T1123Audio Capture |
| Command and Control1 | T1572Protocol Tunneling |
| Impact1 | T1485Data Destruction |
Malware and tools 7
| Name | Description | Platform |
|---|---|---|
| BiBi Wiper | Wiper | Windows/Linux |
| CL Wiper | Wiper | Windows |
| No-Justice | Wiper | Windows |
| Handala Wiper | Custom wiper (handala.exe; file overwrite + MBR wipe), pushed via GPO logon scripts | Windows |
| Handala PowerShell Wiper | AI-assisted PowerShell file-deletion wiper | Windows |
| NetBird | Legitimate zero-trust mesh VPN abused for internal tunnelling | Windows |
| Rhadamanthys | Commodity infostealer | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2019-0604 | 9.8 | Microsoft SharePoint — deserialization RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Starlink internet services used in its operations (MITRE ATT&CK, 2026)
- Operator-run Telegram bots and channels as C2; Telegram personas such as Handala Hack (MITRE ATT&CK, 2026)
Reporting and advisories 10
- Check Point Research
Stryker destructive attack - US DOJ
Handala / Homeland Justice / Karma leak-and-doxxing sites (seized by DOJ 2026-03-19) - Unit 42
Israeli energy/healthcare and Jordan fuel-system claims - MITRE C0038
HomeLand Justice — Albanian government ransomware, wiper and leak operation (MITRE C0038) - Group-IB
HEAVYGRAM Telegram-C2 backdoor against Iranian dissidents and Farsi-language journalists - Recorded Future
Handala doxxing of US forces and physical-sabotage solicitation (HPRF / MOISIRAN personas) - SentinelLabs
California Water Service intrusion claim - MITRE ATT&CK
VOID MANTICORE (G1055) group profile - Check Point Research
Bad Karma, No Justice: Void Manticore Destructive Activities in Israel (May 2024) - ClearSky
No-Justice Wiper — "Homeland Justice" targets Albanian organizations (Jan 2024)