G1055 · ATT&CK 20.0 group
VOID MANTICORE
Aliases: BANISHED KITTEN, COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, Red Sandstorm, VOID MANTICORE
[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)
Aliases: BANISHED KITTEN, COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, Red Sandstorm, VOID MANTICORE
ATT&CK techniques
T1003.001T1005T1021.001T1027.015T1036.004T1036.005T1041T1047T1059.001T1059.006T1071.001T1072T1074T1078T1078.002T1078.004T1082T1087.002T1098T1102T1105T1110T1110.001T1110.004T1113T1114.002T1119T1123T1125T1133T1190T1199T1204.002T1213.002T1219.002T1484.001T1485T1486T1490T1547.001T1552.002T1560.001T1561.001T1561.002T1564.003T1566T1572T1583.001T1583.003T1583.004T1583.006T1585.001T1585.002T1587.001T1588.001T1588.002T1589T1595.002T1651T1657T1679T1684.001T1686.003
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.015 Compression simulation — Exact active technique ID
- T1027.015 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1072 Software Deployment Tools simulation — Exact active technique ID
- T1072 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074 Data Staged simulation — Exact active technique ID
- T1074 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098 Account Manipulation simulation — Exact active technique ID
- T1098 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102 Web Service simulation — Exact active technique ID
- T1102 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.001 Password Guessing simulation — Exact active technique ID
- T1110.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.004 Credential Stuffing simulation — Exact active technique ID
- T1110.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1113 Screen Capture simulation — Exact active technique ID
- T1113 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.002 Remote Email Collection simulation — Exact active technique ID
- T1114.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1123 Audio Capture simulation — Exact active technique ID
- T1123 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1125 Video Capture simulation — Exact active technique ID
- T1125 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.002 Sharepoint simulation — Exact active technique ID
- T1213.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219.002 Remote Desktop Software simulation — Exact active technique ID
- T1219.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1484.001 Group Policy Modification simulation — Exact active technique ID
- T1484.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1490 Inhibit System Recovery simulation — Exact active technique ID
- T1490 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.002 Credentials in Registry simulation — Exact active technique ID
- T1552.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.001 Disk Content Wipe simulation — Exact active technique ID
- T1561.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.002 Disk Structure Wipe simulation — Exact active technique ID
- T1561.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.003 Hidden Window simulation — Exact active technique ID
- T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566 Phishing simulation — Exact active technique ID
- T1566 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1572 Protocol Tunneling simulation — Exact active technique ID
- T1572 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.004 Server simulation — Exact active technique ID
- T1583.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589 Gather Victim Identity Information simulation — Exact active technique ID
- T1589 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1651 Cloud Administration Command simulation — Exact active technique ID
- T1651 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1657 Financial Theft simulation — Exact active technique ID
- T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1679 Selective Exclusion simulation — Exact active technique ID
- T1679 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686.003 Windows Host Firewall simulation — Exact active technique ID
- T1686.003 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name