threat actor · Iran
Handala Hack
1 CVE exploited (1 in CISA KEV) · 63 techniques
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open Handala Hack's actor pageVOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.
Source: MITRE ATT&CK, G1055. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
- Also known as
- VOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm
- Origin
- Iran
- MITRE ATT&CK
- G1055
- On record in
- CyberSIXT · ATT&CK G1055 · MISP Galaxy
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.