Void Manticore

THREAT ACTOR PROFILE

Void Manticore

Void Manticore is an Iranian MOIS-affiliated group that runs destructive wiper attacks and influence operations, mainly against Israel and previously Albania. It operates under hacktivist personas like Homeland Justice and Karma to claim and amplify its attacks, and it often hits victims first compromised by the related actor Scarred Manticore.

Country:

Iran

Government / Critical infrastructure

First seen

2023

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Void Manticore, Homeland Justice and Karma

Void Manticore is tracked under its own name and the personas it hides behind. It maps to one entry among the Iranian state actors we track, and its destructive, persona-driven model overlaps with other Iran-linked crews like Agrius.

GROUP PROFILE

Destruction and influence under false flags

Void Manticore is a destructive actor whose goal is disruption and psychological effect, not profit. It wipes systems and then uses invented personas to publicize the damage, blending cyber operations with information operations.

Our record places its origin as Iran and ties it to destructive attacks against government and critical infrastructure. Check Point documented Void Manticore destructive activity in Israel and Albania, often against targets previously breached by Scarred Manticore.

The group's tradecraft spans custom wipers (including BiBi and a Linux variant), an AI-assisted PowerShell wiper, access via compromised VPN credentials, and lateral movement over RDP and NetBird.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Access into wiping and influence

The stages below come from Void Manticore, Homeland Justice and Karma activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

BiBi and the Handala wipers

Initial Access

CVES EXPLOITED

SharePoint exploitation in some intrusions

Void Manticore mainly relies on compromised credentials and inherited access rather than broad vulnerability exploitation. One flaw tied to the activity in our records is CVE-2019-0604 (Microsoft SharePoint). Detection should focus on the VPN-credential access, RDP and NetBird lateral movement, and the custom wipers the group deploys.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Handala wipers and the Omani mailbox campaign

Recent reporting tracks the group's destructive operations and personas.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through