G1055: VOID MANTICORE

VOID MANTICORE has captured screen content during an active Zoom session.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has conducted password guessing to gain initial access.[4]

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.[4]

VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers.[3] VOID MANTICORE has also utilized legitimate remote disk wiping commands.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.[1][3]

VOID MANTICORE has emailed victims threatening messages.[3] VOID MANTICORE has used phishing as an initial access vector.[4]

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has conducted data exfiltration and posted stolen information on data leak sites for the purposes of financial and political extortion.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[3] VOID MANTICORE has also sold stolen data to prospective buyers for cryptocurrency.[3]

VOID MANTICORE has utilized Telegram API for C2.[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.[1]

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.[1]

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has registered domains for messaging purposes.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026 VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion.[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026 VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex.[3] VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.[4]

VOID MANTICORE has gathered audio during a Zoom session.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.[3]

VOID MANTICORE has gathered victim email-content from victim servers.[3]

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.[1]

VOID MANTICORE has compressed their payloads by leveraging zip files.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications.[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026 VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.[1]

VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.[4]

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.[1]

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[2] VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[2]

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.[1]

VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.[2]

VOID MANTICORE has utilized VPS solutions for C2.[1]

VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity.[1]CitationSPECOPS Outpost24 Handala Hack Stryker March 2026 VOID MANTICORE has also leveraged Starlink internet services.[1] VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.[4]

VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.[1]

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.[1]

VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.[3]

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.[1]

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.[3]

VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.[1]

VOID MANTICORE has leveraged backend servers within Iran.[3]

VOID MANTICORE has deployed additional payloads from dedicated C2 servers.[1][3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026 VOID MANTICORE has also downloaded legitimate tools and software from publicly available services.[1] VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.[1]

VOID MANTICORE has gathered system information and disseminated it back to C2.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune.[2] VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.CitationSEC 8-K Stryker Corporation Filing Handala Hack March 2026

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.[1]

VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.[1]

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file.[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026 VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.[4]

VOID MANTICORE has collected cached data and files from within the victim environment.CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[3]CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.[4]CitationSEC 8K Palo Alto Statement Stryker Corp Handala March 2026

VOID MANTICORE has collected video from compromised victim devices.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.[1]

VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.[3]

VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.[3]

VOID MANTICORE has utilized HTTPS for communication to C2 domains.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.[1]

VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.[4]

VOID MANTICORE has created Telegram Accounts.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026 VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram.[1]CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[3] VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.[4]

VOID MANTICORE has conducted data wiping attacks on compromised systems.[1]CitationSPECOPS Outpost24 Handala Hack Stryker March 2026[3][2] VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.[1][3]

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure.[1] VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems.[4] VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.[1]

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.[1]

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.CitationFBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.[4]

VOID MANTICORE has used RDP to move laterally within the victim environment.[1]