Threat Actor 🇮🇷 Iran

Void Manticore

Void Manticore is an Iranian APT group affiliated with MOIS, known for conducting destructive wiping attacks and influence operations. They collaborate with Scarred Manticore, sharing targets and conducting disruptive operations using custom wipers. Void Manticore's TTPs involve manual file deletion, lateral movement via RDP, and the deployment of custom wipers like the BiBi wiper. The group utilizes online personas like 'Karma' and 'Homeland Justice' to leak information and amplify the impact of their attacks.

Indicators of Compromise 1

Domain api[.]ipify[.]org

MITRE ATT&CK TTPs 12

T1003
OS Credential Dumping
Credential Access
 T1021
Remote Services
Lateral Movement
 T1027
Obfuscated Files or Information
Defense Evasion
 T1056
Input Capture
Collection
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1083
File and Directory Discovery
Discovery
 T1110
Brute Force
Credential Access
 T1204.002
Malicious File
Execution
 T1543.003
Windows Service
Persistence
 T1566
Phishing
Initial Access

Source Articles

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
The Iran-linked threat actor known as Handala Hack, attributed to the MOIS-affiliated group Void Manticore, has been linked to a multi-stage malware campaign using the Telegram-based backdoor HEAVYGRAM and the Delphi-based utility CRUDEEXCLUDE. HEAVYGRAM is a Python-based backdoor that uses Telegram for command-and-control, enabling remote command execution, data exfiltration (including Telegram and WhatsApp data and saved passwords), screenshot capture, and persistence via Windows Registry keys. The malware is delivered through social engineering on messaging platforms, often disguised as legitimate applications like Pictory, KeePass, or Telegram, and leverages PowerShell and DLL sideloading for execution and evasion. CRUDEEXCLUDE prepares the environment by configuring Microsoft Defender exclusions and staging HEAVYGRAM and other payloads.
hacker-news ·22h ago