# VOID MANTICORE - G1055

> As of 2026-10-20, VOID MANTICORE - G1055 is a Iran-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel. Also known as Handala Hack, Karma, KarmaBelow80. ATT&CK coverage spans 37 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1485 (Data Destruction), T1491.002 (External Defacement), T1005 (Data from Local System).

- **Nation:** Iran
- **Tracked threats:** 2
- **Categories:** THREAT_INTEL
- **Also known as:** Handala Hack, Karma, KarmaBelow80
- **As of:** 2026-10-20

## ATT&CK techniques observed

37 techniques observed across 2 of 2 tracked threats. Tactics: Impact (9), Resource Development (5), Initial Access (4), Collection (3), Command and Control (3), Reconnaissance (3).

- [T1485](https://intel.threadlinqs.com/technique/T1485) Data Destruction — Impact — observed in 2 of 2 tracked threats
- [T1491.002](https://intel.threadlinqs.com/technique/T1491.002) External Defacement — Impact — observed in 2 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1056.004](https://intel.threadlinqs.com/technique/T1056.004) Credential API Hooking — Credential Access — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1087](https://intel.threadlinqs.com/technique/T1087) Account Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1090.003](https://intel.threadlinqs.com/technique/T1090.003) Multi-hop Proxy — Command and Control — observed in 1 of 2 tracked threats
- [T1102.002](https://intel.threadlinqs.com/technique/T1102.002) Bidirectional Communication — Command and Control — observed in 1 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 1 of 2 tracked threats

## Tracked threats

- [Evolution of Hacktivism in Hybrid Warfare: NoName057(16), Killnet and Handala Hack Tactics and Real-World Impact](https://intel.threadlinqs.com/threat/TL-2026-3963) — MEDIUM
- [Pro-Iran Hacktivist Ecosystem Uses Telegram to Coordinate DDoS, Hack-and-Leak, and Credential-Theft Campaigns (Handala, 313 Team, Cyber Fattah, Dark Storm, Keymous+, and Affiliated Personas)](https://intel.threadlinqs.com/threat/TL-2026-1309) — MEDIUM

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/VOID%20MANTICORE%20-%20G1055