Threat actor
Handala Hack
Iran
Tracked by CyberSIXT since 12 Mar
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
4 articles from 1 outlet since 12 Mar; the latest 34 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 22 Sep · 07:11 UTC | SecurityOnline | Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram Accounts |
| Thu 7 May · 23:25 UTC | dti.domaintools.com | Fake Google Authenticator Chrome Extension Hits 260k Users |
| Thu 12 Mar · 22:19 UTC | Unit 42 | Insights: Increased Risk of Wiper Attacks |
| Thu 12 Mar · 17:45 UTC | Check Point | “Handala Hack” – Unveiling Group’s Modus Operandi |
Names and sources
- Void Manticore
- Named by CyberSIXT coverage
- Void Manticore
- Named by Malpedia · void_manticore
- Void Manticore
- Named by MISP Galaxy · 53ac2695-35ba-4ab2-a5cd-48ca533f1b72
- BANISHED KITTEN
- Named by MITRE ATT&CK® · G1055
- COBALT MYSTIQUE
- Named by MITRE ATT&CK® · G1055
- Handala Hack
- Named by MITRE ATT&CK® · G1055
- Homeland Justice
- Named by MITRE ATT&CK® · G1055
- Karma
- Named by MITRE ATT&CK® · G1055
All 13 names
- Karmabelow80
- Named by MITRE ATT&CK® · G1055
- Red Sandstorm
- Named by MITRE ATT&CK® · G1055
- VOID MANTICORE
- Named by MITRE ATT&CK® · G1055
- Karma/KarmaBelow80
- Named by CyberSIXT coverage
- 53ac2695-35ba-4ab2-a5cd-48ca533f1b72
- Named by CyberSIXT coverage
Attributed facts
- origin
- Iran (MISP Galaxy · 53ac2695-35ba-4ab2-a5cd-48ca533f1b72)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1055
Tactics pending refresh
- T1003.001
- LSASS Memory
- T1005
- Data from Local System
- T1021.001
- Remote Desktop Protocol
- T1027.015
- Compression
- T1036.004
- Masquerade Task or Service
- T1036.005
- Match Legitimate Resource Name or Location
- T1041
- Exfiltration Over C2 Channel
- T1047
- Windows Management Instrumentation
- T1059.001
- PowerShell
- T1059.006
- Python
- T1071.001
- Web Protocols
- T1072
- Software Deployment Tools
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Iran-Linked Handala Hack Uses HEAVYGRAM to Hijack Telegram AccountsSecurityOnline
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- Insights: Increased Risk of Wiper AttacksUnit 42
- “Handala Hack” – Unveiling Group’s Modus OperandiCheck Point · first in our coverage