Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using custom wipers. Void Manticore's TTPs involve manual file deletion, lateral movement via RDP, and the deployment of custom wipers like the BiBi wiper. The group utilizes online personas like 'Karma' and 'Homeland Justice' to leak information and amplify the impact of their attacks.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | VOID MANTICORE |
| OSINT | COBALT MYSTIQUE |
| OSINT | Handala Hack |
| OSINT | Homeland Justice |
| OSINT | Karma |
| OSINT | Karmabelow80 |
| OSINT | BANISHED KITTEN |
| OSINT | Red Sandstorm |
Top 10 by how many reports mention them.
Every report in the Global Intel Library that names Void Manticore, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Void Manticore. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.