LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

EnterpriseG1055GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

MITRE describes VOID MANTICORE as an Iran MOIS-linked threat group active since at least mid-2022, associated with destructive operations that combine wiper activity and hack-and-leak campaigns. For leaders, the material issue is not just espionage: the mapped behavior points to credential abuse, lateral movement, data collection/exfiltration, and destructive disruption against government, critical infrastructure, and private-sector targets.

Executive priority

Prioritize this as an operational resilience and identity-risk scenario. The ATT&CK relationships emphasize valid account abuse, domain and cloud account misuse, LSASS credential access, RDP, WMI, PowerShell, software deployment tools, data staging, and exfiltration over C2. Executives should ask whether identity controls, privileged access monitoring, backup/recovery, and incident communications are ready for a combined data-theft, public-leak, and destructive-impact event.

Technical view

SOC and IR teams should validate coverage across the mapped behaviors rather than relying on a single group indicator. Key areas include Windows credential theft from LSASS, domain account discovery, RDP and WMI-based lateral movement/execution, PowerShell and Python execution, software deployment tool abuse, account manipulation, cloud account misuse, web-based C2, tool ingress, data staging, compression, and exfiltration over C2 channels. The HomeLand Justice relationship adds context for disruptive operations involving ransomware, wiper malware, data leaks, lateral movement, exfiltration, persistence, and long dwell time before public impact.

Likely telemetry

  • Identity provider and cloud/SaaS sign-in logs, including failed login patterns, successful logins, MFA outcomes, source locations, and account changes
  • Active Directory/domain controller logs for domain account enumeration, group membership changes, authentication events, and privileged account use
  • Endpoint telemetry for LSASS access, suspicious process creation, PowerShell execution, Python execution, WMI activity, service/task creation, and masqueraded names or locations
  • Remote access logs for RDP sessions, especially unusual source/destination pairs, off-hours use, or administrative logons
  • Software deployment and systems management platform logs showing package creation, job execution, remote command execution, and administrative changes

Detection direction

  • Because MITRE provides no official detection text for this object, build detections from the related ATT&CK techniques and validate them against local administrative baselines.
  • Correlate credential-access signals with follow-on behavior: LSASS access, password guessing, valid account use, RDP, WMI, and domain account discovery become more meaningful when seen in sequence.
  • Tune for abuse of legitimate administration paths, especially RDP, WMI, PowerShell, Python, and software deployment tools; false positives are likely unless detections include user role, host criticality, change window, and source context.
  • Monitor identity and cloud-account changes for persistence and privilege escalation, including account manipulation and suspicious use of domain or cloud accounts.
  • Look for collection-to-exfiltration chains: local data access, staging, compression, outbound web traffic, use of web services, and exfiltration over an existing C2 channel.

Mitigation priorities

  • Harden identity first: enforce strong authentication, reduce password-guessing exposure, review privileged/domain/cloud accounts, and monitor account manipulation.
  • Limit lateral movement and administrative abuse by restricting RDP, WMI, PowerShell, Python, and software deployment tool access to approved administrators and managed systems.
  • Protect credential material by reducing unnecessary administrative privileges and validating controls around LSASS access on Windows systems.
  • Improve egress governance by monitoring and controlling outbound web protocols, external web services, and unusual data-transfer patterns.
  • Reduce impact risk through tested backups, recovery procedures, segmentation, and incident playbooks for destructive events and hack-and-leak communications.
Additional notes and limits

This take is based on ATT&CK group G1055, its aliases, official description, external references, and the supplied relationships to HomeLand Justice and related techniques. The source material supports a focus on destructive operations, hack-and-leak activity, credential abuse, lateral movement, data collection, exfiltration, web-based C2, and account misuse.

The group object lists no platforms, tactics, or official detection guidance. Platform and tactic discussion is derived from the related ATT&CK techniques, not from an explicit platform list on the group object. Local exposure, active targeting, and detection coverage cannot be inferred from ATT&CK alone and require environment-specific telemetry and threat intelligence validation.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

63 rows
DomainIDNameRelationship / procedure
EnterpriseT1113Screen Capture

VOID MANTICORE has captured screen content during an active Zoom session.[5]

EnterpriseT1110.001Password GuessingSub-technique

VOID MANTICORE has conducted password guessing to gain initial access.[4]

EnterpriseT1119Automated Collection

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.[4]

EnterpriseT1561.001Disk Content WipeSub-technique

VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers.[3] VOID MANTICORE has also utilized legitimate remote disk wiping commands.[6]

EnterpriseT1486Data Encrypted for Impact

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.[1][3]

EnterpriseT1566Phishing

VOID MANTICORE has emailed victims threatening messages.[3] VOID MANTICORE has used phishing as an initial access vector.[4]

EnterpriseT1589Gather Victim Identity Information

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.[5]

EnterpriseT1657Financial Theft

VOID MANTICORE has conducted data exfiltration and posted stolen information on data leak sites for the purposes of financial and political extortion.[6][3] VOID MANTICORE has also sold stolen data to prospective buyers for cryptocurrency.[3]

EnterpriseT1102Web Service

VOID MANTICORE has utilized Telegram API for C2.[3][5]

EnterpriseT1059.001PowerShellSub-technique

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.[3][5]

EnterpriseT1047Windows Management Instrumentation

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.[1]

EnterpriseT1484.001Group Policy ModificationSub-technique

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.[1]

EnterpriseT1564.003Hidden WindowSub-technique

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.[5]

EnterpriseT1583.001DomainsSub-technique

VOID MANTICORE has registered domains for messaging purposes.[6] VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion.[3][5] VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex.[3] VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.[4]

EnterpriseT1123Audio Capture

VOID MANTICORE has gathered audio during a Zoom session.[5]

EnterpriseT1190Exploit Public-Facing Application

VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.[3]

EnterpriseT1114.002Remote Email CollectionSub-technique

VOID MANTICORE has gathered victim email-content from victim servers.[3]

EnterpriseT1074Data Staged

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.[5]

EnterpriseT1078.002Domain AccountsSub-technique

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.[1]

EnterpriseT1027.015CompressionSub-technique

VOID MANTICORE has compressed their payloads by leveraging zip files.[5]

EnterpriseT1684.001ImpersonationSub-technique

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.[5]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications.[3][5] VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.[5]

EnterpriseT1679Selective Exclusion

VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.[5]

EnterpriseT1087.002Domain AccountSub-technique

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.[1]

EnterpriseT1588.001MalwareSub-technique

VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.[4]

EnterpriseT1490Inhibit System Recovery

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.[1]

EnterpriseT1072Software Deployment Tools

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions.[6][2] VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.[6][2]

EnterpriseT1003.001LSASS MemorySub-technique

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.[1]

EnterpriseT1651Cloud Administration Command

VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.[2]

EnterpriseT1583.003Virtual Private ServerSub-technique

VOID MANTICORE has utilized VPS solutions for C2.[1]

EnterpriseT1583.006Web ServicesSub-technique

VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity.[1][6] VOID MANTICORE has also leveraged Starlink internet services.[1] VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.[4]

EnterpriseT1686.003Windows Host FirewallSub-technique

VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.[1]

EnterpriseT1552.002Credentials in RegistrySub-technique

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.[1]

EnterpriseT1213.002SharepointSub-technique

VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.[3]

EnterpriseT1219.002Remote Desktop SoftwareSub-technique

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.[1]

EnterpriseT1595.002Vulnerability ScanningSub-technique

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.[3]

EnterpriseT1561.002Disk Structure WipeSub-technique

VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.[1]

EnterpriseT1583.004ServerSub-technique

VOID MANTICORE has leveraged backend servers within Iran.[3]

EnterpriseT1105Ingress Tool Transfer

VOID MANTICORE has deployed additional payloads from dedicated C2 servers.[1][3][5] VOID MANTICORE has also downloaded legitimate tools and software from publicly available services.[1] VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.[1]

EnterpriseT1082System Information Discovery

VOID MANTICORE has gathered system information and disseminated it back to C2.[5]

EnterpriseT1078.004Cloud AccountsSub-technique

VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune.[2] VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.[7]

EnterpriseT1133External Remote Services

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.[1]

EnterpriseT1588.002ToolSub-technique

VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.[5]

EnterpriseT1204.002Malicious FileSub-technique

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file.[3][5] VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.[4]

EnterpriseT1005Data from Local System

VOID MANTICORE has collected cached data and files from within the victim environment.[6][3][5]

EnterpriseT1098Account Manipulation

VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.[4][8]

EnterpriseT1125Video Capture

VOID MANTICORE has collected video from compromised victim devices.[5]

EnterpriseT1572Protocol Tunneling

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.[1]

EnterpriseT1587.001MalwareSub-technique

VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.[3]

EnterpriseT1585.002Email AccountsSub-technique

VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

VOID MANTICORE has utilized HTTPS for communication to C2 domains.[5]

EnterpriseT1199Trusted Relationship

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.[1]

EnterpriseT1110.004Credential StuffingSub-technique

VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.[4]

EnterpriseT1585.001Social Media AccountsSub-technique

VOID MANTICORE has created Telegram Accounts.[5] VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram.[1][6][3] VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.[4]

EnterpriseT1485Data Destruction

VOID MANTICORE has conducted data wiping attacks on compromised systems.[1][6][3][2] VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.[1][3]

EnterpriseT1078Valid Accounts

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure.[1] VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems.[4] VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.[1]

EnterpriseT1110Brute Force

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.[5]

EnterpriseT1059.006PythonSub-technique

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.[5]

EnterpriseT1560.001Archive via UtilitySub-technique

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.[5]

EnterpriseT1041Exfiltration Over C2 Channel

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.[4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

VOID MANTICORE has used RDP to move laterally within the victim environment.[1]

Associated objects

Groups, software, and campaigns

CampaignEnterprise

C0038: HomeLand Justice

HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure.[1][2][3] A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.[3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1110.001: Password GuessingEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1561.001: Disk Content WipeEnterpriseattributed to · CampaignC0038: HomeLand JusticeEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1566: PhishingEnterpriseuses · TechniqueT1589: Gather Victim Identity InformationEnterpriseuses · TechniqueT1657: Financial TheftEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1484.001: Group Policy ModificationEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1114.002: Remote Email CollectionEnterpriseuses · TechniqueT1074: Data StagedEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1684.001: ImpersonationEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1679: Selective ExclusionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
3196289b91d0019d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle3196289b91d0…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  2. [2]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  3. [3]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  4. [4]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  5. [5]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  6. [6]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  7. [7]
    SEC 8-K Stryker Corporation Filing Handala Hack March 2026

    Stryker Corporation. (2026, March 23). SEC 8-K Stryker Corporation. Retrieved April 20, 2026.

    Open source URL
  8. [8]
    SEC 8K Palo Alto Statement Stryker Corp Handala March 2026

    Troy Bettencourt. (2026, March 20). SEC 8k: Stryker Corporation Partner and Customer Connections to the Stryker Environment. Retrieved April 20, 2026.

    Open source URL
  9. [9]
    BANISHED KITTEN

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  10. [10]
    BANISHED KITTEN

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  11. [11]
    BANISHED KITTEN

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  12. [12]
    COBALT MYSTIQUE

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  13. [13]
    COBALT MYSTIQUE

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  14. [14]
    COBALT MYSTIQUE

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  15. [15]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  16. [16]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  17. [17]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  18. [18]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  19. [19]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  20. [20]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  21. [21]
    Handala Hack

    (Citation: DOJ FBI Handala Hack March 2026)

  22. [22]
    Handala Hack

    (Citation: DOJ FBI Handala Hack March 2026)

  23. [23]
    Handala Hack

    (Citation: DOJ FBI Handala Hack March 2026)

  24. [24]
    Homeland Justice

    (Citation: DOJ FBI Handala Hack March 2026)

  25. [25]
    Homeland Justice

    (Citation: DOJ FBI Handala Hack March 2026)

  26. [26]
    Homeland Justice

    (Citation: DOJ FBI Handala Hack March 2026)

  27. [27]
    Karma

    (Citation: DOJ FBI Handala Hack March 2026)

  28. [28]
    Karma

    (Citation: DOJ FBI Handala Hack March 2026)

  29. [29]
    Karma

    (Citation: DOJ FBI Handala Hack March 2026)

  30. [30]
    Karmabelow80

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  31. [31]
    Karmabelow80

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  32. [32]
    Karmabelow80

    (Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)

  33. [33]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  34. [34]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  35. [35]
    Red Sandstorm

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  36. [36]
    Red Sandstorm

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  37. [37]
    Red Sandstorm

    (Citation: Check Point VOID MANTICORE Handala Hack March 2026)

  38. [38]
    Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026

    Sophos. (2026, April 20). Iran COBALT MYSTIQUE. Retrieved April 20, 2026.

    Open source URL
  39. [39]
    Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026

    Sophos. (2026, April 20). Iran COBALT MYSTIQUE. Retrieved April 20, 2026.

    Open source URL
  40. [40]
    Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026

    Sophos. (2026, April 20). Iran COBALT MYSTIQUE. Retrieved April 20, 2026.

    Open source URL
  41. [41]
    mitre-attackG1055
    Open source URL
  42. [42]
    mitre-attackG1055
    Open source URL
  43. [43]
    mitre-attackG1055
    Open source URL
  44. [44]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  45. [45]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  46. [46]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  47. [47]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  48. [48]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  49. [49]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  50. [50]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  51. [51]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  52. [52]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  53. [53]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  54. [54]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  55. [55]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  56. [56]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  57. [57]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  58. [58]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  59. [59]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  60. [60]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  61. [61]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  62. [62]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  63. [63]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  64. [64]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  65. [65]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  66. [66]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  67. [67]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  68. [68]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  69. [69]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  70. [70]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  71. [71]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  72. [72]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  73. [73]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  74. [74]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  75. [75]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  76. [76]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  77. [77]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  78. [78]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  79. [79]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  80. [80]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  81. [81]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  82. [82]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  83. [83]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  84. [84]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  85. [85]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  86. [86]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  87. [87]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  88. [88]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  89. [89]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  90. [90]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  91. [91]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  92. [92]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  93. [93]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  94. [94]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  95. [95]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  96. [96]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  97. [97]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  98. [98]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  99. [99]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  100. [100]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  101. [101]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  102. [102]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  103. [103]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  104. [104]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  105. [105]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  106. [106]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  107. [107]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  108. [108]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  109. [109]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  110. [110]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  111. [111]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  112. [112]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  113. [113]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  114. [114]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  115. [115]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  116. [116]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  117. [117]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  118. [118]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  119. [119]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  120. [120]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  121. [121]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  122. [122]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  123. [123]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  124. [124]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  125. [125]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  126. [126]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  127. [127]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  128. [128]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  129. [129]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  130. [130]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  131. [131]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  132. [132]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  133. [133]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  134. [134]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  135. [135]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  136. [136]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  137. [137]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  138. [138]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  139. [139]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  140. [140]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  141. [141]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  142. [142]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  143. [143]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  144. [144]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  145. [145]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  146. [146]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  147. [147]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  148. [148]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  149. [149]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  150. [150]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  151. [151]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  152. [152]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  153. [153]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  154. [154]
    SEC 8-K Stryker Corporation Filing Handala Hack March 2026

    Stryker Corporation. (2026, March 23). SEC 8-K Stryker Corporation. Retrieved April 20, 2026.

    Open source URL
  155. [155]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  156. [156]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  157. [157]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  158. [158]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  159. [159]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  160. [160]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  161. [161]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  162. [162]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  163. [163]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  164. [164]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  165. [165]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  166. [166]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  167. [167]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  168. [168]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  169. [169]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  170. [170]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  171. [171]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  172. [172]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  173. [173]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  174. [174]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  175. [175]
    SEC 8K Palo Alto Statement Stryker Corp Handala March 2026

    Troy Bettencourt. (2026, March 20). SEC 8k: Stryker Corporation Partner and Customer Connections to the Stryker Environment. Retrieved April 20, 2026.

    Open source URL
  176. [176]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  177. [177]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  178. [178]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  179. [179]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  180. [180]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  181. [181]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  182. [182]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  183. [183]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  184. [184]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  185. [185]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  186. [186]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  187. [187]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  188. [188]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  189. [189]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  190. [190]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  191. [191]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  192. [192]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  193. [193]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  194. [194]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  195. [195]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  196. [196]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  197. [197]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  198. [198]
    FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

    FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026.

    Open source URL
  199. [199]
    Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

    DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.

    Open source URL
  200. [200]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use