← All threat actorsThreat actors

Handala

0CVEs
77Techniques
0Tools
5Leak sites

Overview

Not a Ransomware Group

What public reporting says

Also known as: Handala Hack Team · Void Manticore · Homeland Justice · Karma

  • Check Point attributed the Handala persona to Void Manticore in May 2024, and Palo Alto Networks and others describe it as a front for a destructive unit linked to Iran’s Ministry of Intelligence and Security (MOIS).
  • On 11 March 2026 it claimed a wiper attack on Stryker that abused Microsoft Intune to wipe managed devices across the company. Analysts read it as retaliation for the strikes that began in late February.

Krebs on Security · Cloud Security Alliance

Geography: origin and targets

Israel: 70United States of America: 9Islamic Republic of Iran: 4State of Palestine: 2United Kingdom: 2Saudi Arabia: 1United Arab Emirates: 1Ecuador: 1Canada: 1Italy: 1People's Republic of China: 1Russian Federation: 1Argentina: 1Netherlands: 1Syrian Arab Republic: 1Switzerland: 1Handala · Islamic Republic of IranHA

Assessed origin: Islamic Republic of Iran. Public assessments tie the persona to Iran’s Ministry of Intelligence and Security (MOIS). Attribution is uncertain: read it as an assessment, not proof.

  1. Israel70
  2. United States of America9
  3. Islamic Republic of Iran4
  4. State of Palestine2
  5. United Kingdom2
  6. Saudi Arabia1
  7. United Arab Emirates1
  8. Ecuador1
  9. Canada1
  10. Italy1

Exploited vulnerabilities

None recorded in the sources we reviewed.

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial AccessExecutionPersistencePrivilege EscalationStealthCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlImpactResource DevelopmentReconnaissanceDefense Impairment
Valid AccountsWindows Management InstrumentationValid AccountsValid AccountsObfuscated Files or Information: CompressionOS Credential Dumping: LSASS MemorySystem Information DiscoveryRemote Services: Remote Desktop ProtocolData from Local SystemExfiltration Over C2 ChannelApplication Layer Protocol: Web ProtocolsData DestructionAcquire Infrastructure: DomainsGather Victim Identity InformationDomain or Tenant Policy Modification: Group Policy Modification
Valid Accounts: Domain AccountsCommand and Scripting Interpreter: PowerShellValid Accounts: Domain AccountsValid Accounts: Domain AccountsMasquerading: Masquerade Task or ServiceBrute ForceAccount Discovery: Domain AccountSoftware Deployment ToolsData StagedWeb ServiceData Encrypted for ImpactAcquire Infrastructure: Virtual Private ServerActive Scanning: Vulnerability ScanningDisable or Modify System Firewall: Windows Host Firewall
Valid Accounts: Cloud AccountsCommand and Scripting Interpreter: PythonValid Accounts: Cloud AccountsValid Accounts: Cloud AccountsMasquerading: Match Legitimate Resource Name or LocationBrute Force: Password GuessingScreen CaptureIngress Tool TransferInhibit System RecoveryAcquire Infrastructure: Server
External Remote ServicesSoftware Deployment ToolsAccount ManipulationAccount ManipulationValid AccountsBrute Force: Credential StuffingEmail Collection: Remote Email CollectionRemote Access Tools: Remote Desktop SoftwareDisk Wipe: Disk Content WipeAcquire Infrastructure: Web Services
Exploit Public-Facing ApplicationUser Execution: Malicious FileExternal Remote ServicesDomain or Tenant Policy Modification: Group Policy ModificationValid Accounts: Domain AccountsUnsecured Credentials: Credentials in RegistryAutomated CollectionProtocol TunnelingDisk Wipe: Disk Structure WipeEstablish Accounts: Social Media Accounts
Trusted RelationshipCloud Administration CommandBoot or Logon Autostart Execution: Registry Run Keys / Startup FolderBoot or Logon Autostart Execution: Registry Run Keys / Startup FolderValid Accounts: Cloud AccountsAudio CaptureFinancial TheftEstablish Accounts: Email Accounts
PhishingHide Artifacts: Hidden WindowVideo CaptureDevelop Capabilities: Malware
Selective ExclusionData from Information Repositories: SharepointObtain Capabilities: Malware
Social Engineering: ImpersonationArchive Collected Data: Archive via UtilityObtain Capabilities: Tool

Technique details

Initial Access (TA0001)
  • T1078 · Valid Accounts: VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.
  • T1078.002 · Valid Accounts: Domain Accounts: VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.
  • T1078.004 · Valid Accounts: Cloud Accounts: VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.
  • T1133 · External Remote Services: VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.
  • T1190 · Exploit Public-Facing Application: VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.
  • T1199 · Trusted Relationship: VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.
  • T1566 · Phishing: VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector.
Execution (TA0002)
  • T1047 · Windows Management Instrumentation: VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.
  • T1059.001 · Command and Scripting Interpreter: PowerShell: VOID MANTICORE has utilized PowerShell to execute malware in victim environments.
  • T1059.006 · Command and Scripting Interpreter: Python: VOID MANTICORE has utilized Python scripts to execute its malicious payloads.
  • T1072 · Software Deployment Tools: VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.
  • T1204.002 · User Execution: Malicious File: VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.
  • T1651 · Cloud Administration Command: VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.
Persistence (TA0003)
  • T1078 · Valid Accounts: VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.
  • T1078.002 · Valid Accounts: Domain Accounts: VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.
  • T1078.004 · Valid Accounts: Cloud Accounts: VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.
  • T1098 · Account Manipulation: VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.
  • T1133 · External Remote Services: VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.
  • T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.
Privilege Escalation (TA0004)
  • T1078 · Valid Accounts: VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.
  • T1078.002 · Valid Accounts: Domain Accounts: VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.
  • T1078.004 · Valid Accounts: Cloud Accounts: VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.
  • T1098 · Account Manipulation: VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.
  • T1484.001 · Domain or Tenant Policy Modification: Group Policy Modification: VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.
  • T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.
Stealth (TA0005)
  • T1027.015 · Obfuscated Files or Information: Compression: VOID MANTICORE has compressed their payloads by leveraging zip files.
  • T1036.004 · Masquerading: Masquerade Task or Service: VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.
  • T1036.005 · Masquerading: Match Legitimate Resource Name or Location: VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications. VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.
  • T1078 · Valid Accounts: VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.
  • T1078.002 · Valid Accounts: Domain Accounts: VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.
  • T1078.004 · Valid Accounts: Cloud Accounts: VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.
  • T1564.003 · Hide Artifacts: Hidden Window: VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.
  • T1679 · Selective Exclusion: VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.
  • T1684.001 · Social Engineering: Impersonation: VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.
Credential Access (TA0006)
  • T1003.001 · OS Credential Dumping: LSASS Memory: VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.
  • T1110 · Brute Force: VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.
  • T1110.001 · Brute Force: Password Guessing: VOID MANTICORE has conducted password guessing to gain initial access.
  • T1110.004 · Brute Force: Credential Stuffing: VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.
  • T1552.002 · Unsecured Credentials: Credentials in Registry: VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.
Discovery (TA0007)
  • T1082 · System Information Discovery: VOID MANTICORE has gathered system information and disseminated it back to C2.
  • T1087.002 · Account Discovery: Domain Account: VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.
Lateral Movement (TA0008)
  • T1021.001 · Remote Services: Remote Desktop Protocol: VOID MANTICORE has used RDP to move laterally within the victim environment.
  • T1072 · Software Deployment Tools: VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.
Collection (TA0009)
  • T1005 · Data from Local System: VOID MANTICORE has collected cached data and files from within the victim environment.
  • T1074 · Data Staged: VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.
  • T1113 · Screen Capture: VOID MANTICORE has captured screen content during an active Zoom session.
  • T1114.002 · Email Collection: Remote Email Collection: VOID MANTICORE has gathered victim email-content from victim servers.
  • T1119 · Automated Collection: VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.
  • T1123 · Audio Capture: VOID MANTICORE has gathered audio during a Zoom session.
  • T1125 · Video Capture: VOID MANTICORE has collected video from compromised victim devices.
  • T1213.002 · Data from Information Repositories: Sharepoint: VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.
  • T1560.001 · Archive Collected Data: Archive via Utility: VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.
Exfiltration (TA0010)
  • T1041 · Exfiltration Over C2 Channel: VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.
Command and Control (TA0011)
  • T1071.001 · Application Layer Protocol: Web Protocols: VOID MANTICORE has utilized HTTPS for communication to C2 domains.
  • T1102 · Web Service: VOID MANTICORE has utilized Telegram API for C2.
  • T1105 · Ingress Tool Transfer: VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.
  • T1219.002 · Remote Access Tools: Remote Desktop Software: VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.
  • T1572 · Protocol Tunneling: VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.
Impact (TA0040)
  • T1485 · Data Destruction: VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.
  • T1486 · Data Encrypted for Impact: VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.
  • T1490 · Inhibit System Recovery: VOID MANTICORE has deleted virtual machines directly from the virtualization platform.
  • T1561.001 · Disk Wipe: Disk Content Wipe: VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers. VOID MANTICORE has also utilized legitimate remote disk wiping commands.
  • T1561.002 · Disk Wipe: Disk Structure Wipe: VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.
  • T1657 · Financial Theft: VOID MANTICORE has conducted data exfiltration and posted stolen information on data leak sites for the purposes of financial and political extortion. VOID MANTICORE has also sold stolen data to prospective buyers for cryptocurrency.
Resource Development (TA0042)
  • T1583.001 · Acquire Infrastructure: Domains: VOID MANTICORE has registered domains for messaging purposes. VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion. VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex. VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.
  • T1583.003 · Acquire Infrastructure: Virtual Private Server: VOID MANTICORE has utilized VPS solutions for C2.
  • T1583.004 · Acquire Infrastructure: Server: VOID MANTICORE has leveraged backend servers within Iran.
  • T1583.006 · Acquire Infrastructure: Web Services: VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity. VOID MANTICORE has also leveraged Starlink internet services. VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.
  • T1585.001 · Establish Accounts: Social Media Accounts: VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.
  • T1585.002 · Establish Accounts: Email Accounts: VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.
  • T1587.001 · Develop Capabilities: Malware: VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.
  • T1588.001 · Obtain Capabilities: Malware: VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.
  • T1588.002 · Obtain Capabilities: Tool: VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.
Reconnaissance (TA0043)
  • T1589 · Gather Victim Identity Information: VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.
  • T1595.002 · Active Scanning: Vulnerability Scanning: VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.
Defense Impairment (TA0112)
  • T1484.001 · Domain or Tenant Policy Modification: Group Policy Modification: VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.
  • T1686.003 · Disable or Modify System Firewall: Windows Host Firewall: VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.

Tools

None recorded in the sources we reviewed.

Leak-site infrastructure

TitleTypeAddress (defanged)Seen online at snapshot
Error Response PageDLShandala-team[.]toNo
This Website Has Been SeizedDLShandala-hack[.]toYes
Security VerificationDLShandala-hack[.]twYes
—DLSvmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd[.]onionNo
HeadlineLogic News PortalDLShandala[.]toYes

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-11