VOID MANTICORE

OriginIrã

Techniques (MITRE ATT&CK)63

SourceMITRE ATT&CK

Also known as:COBALT MYSTIQUEHandala HackHomeland JusticeKarmaKarmabelow80BANISHED KITTENRed Sandstorm

Vexday analysis

VOID MANTICORE é um grupo de ameaça persistente avançada (APT) de origem iraniana, avaliado como operando em nome do Ministério de Inteligência e Segurança do Irã (MOIS), ativo pelo menos desde meados de 2022. O grupo tem como alvos entidades governamentais, infraestrutura crítica e organizações do setor privado na Albânia, em Israel e nos Estados Unidos, conduzindo operações cibernéticas destrutivas que combinam ataques com wipers e campanhas de hack-and-leak. Para essas operações, o VOID MANTICORE adota múltiplas personas públicas, entre elas HomeLand Justice — utilizada em ações contra a Albânia — e Karma e Karma Below — empregadas em campanhas direcionadas a organizações israelenses. Catalogado no MITRE ATT&CK como G1055, o grupo acumula 63 técnicas documentadas e é associado à exploração de 3 CVEs.

Techniques (MITRE ATT&CK) 63

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Vulnerability Scanning

Resource development

Domains Virtual Private Server Server Web Services Social Media Accounts Email Accounts Malware Malware Tool

Initial access

Exploit Public-Facing Application Trusted Relationship Phishing

Execution

Windows Management Instrumentation PowerShell Python Software Deployment Tools Malicious File Cloud Administration Command

Persistence

Account Manipulation External Remote Services Registry Run Keys / Startup Folder

Credential access

LSASS Memory Brute Force Password Guessing Credential Stuffing Credentials in Registry

Discovery

System Information Discovery Domain Account

Lateral movement

Remote Desktop Protocol

Collection

Data from Local System Data Staged Screen Capture Remote Email Collection Automated Collection Audio Capture Video Capture Sharepoint Archive via Utility

Command and control

Web Protocols Web Service Ingress Tool Transfer Remote Desktop Software Protocol Tunneling

Exfiltration

Exfiltration Over C2 Channel

Impact

Data Destruction Data Encrypted for Impact Inhibit System Recovery Disk Content Wipe Disk Structure Wipe Financial Theft

defense-impairment

Group Policy Modification Windows Host Firewall

stealth

Compression Masquerade Task or Service Match Legitimate Resource Name or Location Valid Accounts Domain Accounts Cloud Accounts Hidden Window Selective Exclusion Impersonation

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2019-0604CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

VOID MANTICORE uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →