# Iranian MOIS Actors Leveraging Cybercrime Ecosystem — Void Manticore & MuddyWater Campaign

> Iranian MOIS-affiliated threat actors Void Manticore and MuddyWater have evolved from imitating cybercriminals to actively leveraging criminal ecosystems including Qilin RaaS, CastleLoader MaaS, and Rhadamanthys infostealer. Campaigns target Israeli healthcare, U.S. critical infrastructure, and Middle Eastern government sectors with phishing, code-signing abuse, wiper malware, and multi-stage delivery chains.

- **Published:** 2026-03-12T12:00:00Z
- **Last reviewed:** 2026-03-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0215
- **ID:** TL-2026-0215
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Void Manticore (Iran)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Research published a comprehensive analysis on March 10, 2026 documenting how Iranian Ministry of Intelligence and Security (MOIS) threat actors have fundamentally shifted their operational model. Rather than merely mimicking cybercriminal behavior for cover, Void Manticore and MuddyWater now actively participate in criminal ecosystems as affiliates and customers, gaining access to mature tooling, resilient infrastructure, and tested extortion playbooks.

Void Manticore (tracked by Microsoft as Storm-0842, also known as Banished Kitten) operates multiple hack-and-leak personas including Homeland Justice (targeting Albania), Karma, and Handala (targeting Israel). The Handala persona campaigns revealed deployment of Rhadamanthys, a commercial infostealer sold on darknet forums. In several campaigns, Void Manticore operators paired Rhadamanthys with custom wiper malware in phishing emails impersonating the Israeli National Cyber Directorate and F5 software updates. This combination of high-end espionage, data theft, and sabotage with off-the-shelf criminal tooling represents a significant operational evolution.

MuddyWater (tracked as Mango Sandstorm, Seedworm, TEMP.Zagros, Static Kitten, Earth Vetala), confirmed by CISA as a subordinate element within MOIS, has been linked to the Tsundere botnet uncovered in late 2025. The Tsundere botnet uses Node.js and JavaScript scripts for code execution on compromised systems, with the ability to dynamically switch to the Deno runtime — this Deno-based variant has been designated DinDoor. MuddyWater campaigns in early 2026 compromised U.S. banks, airports, and software companies supplying defense/aerospace sectors. The FakeSet Python-based downloader delivers CastleLoader malware-as-a-service payloads, with both tools signed using suspicious code-signing certificates bearing the names Amy Cherne and Donald Gay.

The October 2025 ransomware attack on Shamir Medical Center in Israel was initially attributed to the Qilin ransomware group but Israeli assessments later pointed to Iranian actors as the true operators. By working through Qilin's established RaaS franchise, Iranian actors gained plausible deniability, hardened infrastructure, and tested extortion playbooks. This forms part of a broader MOIS and Hezbollah campaign targeting Israeli hospitals.

Code-signing certificate overlap across FakeSet, CastleLoader, StageComp, DarkComp, and DinDoor samples suggests shared certificate acquisition sources between these tools, though not necessarily shared operators. Data exfiltration via rclone to Wasabi cloud storage has been observed in MuddyWater operations, with IP 18.223.24.218 identified as a Wasabi server previously associated with MuddyWater activity.

This convergence of state-sponsored and criminal cyber operations mirrors MOIS's physical-world use of criminal networks for kidnappings, assassinations, and dissident targeting, as documented by the U.S. Treasury Department. The implications for defenders are significant: attribution becomes more complex, tooling more sophisticated, and the operational tempo higher as state actors leverage commercial criminal infrastructure.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1074 Data Staged
- T1113 Screen Capture
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1104 Multi-Stage Channels
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1561 Disk Wipe
- T1490 Inhibit System Recovery
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure

## Sources

- [Check Point Research: Iranian MOIS Actors & the Cyber Crime Connection](https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/)
- [Malpedia Library Entry — MOIS Cyber Crime Connection](https://malpedia.caad.fkie.fraunhofer.de/library/265debed-972f-4c4d-aa2a-9fcd297bec4a/)
- [The Register: Cybercrime Isn't Just a Cover for Iran's Government Goons](https://www.theregister.com/2026/03/10/cybercrime_iran_mois/)
- [The Hacker News: Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [Check Point Blog: What Defenders Need to Know about Iran's Cyber Capabilities](https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/)
- [Security Boulevard: Cyber Retaliation — Analyzing Iranian Cyber Activity Following Operation Epic Fury](https://securityboulevard.com/2026/03/cyber-retaliation-analyzing-iranian-cyber-activity-following-operation-epic-fury/)
- [GBHackers: Iran-Linked Hackers Tap Criminal Ecosystem to Bolster State Cyber Ops](https://gbhackers.com/iran-linked-hackers-2/)
- [Industrial Cyber: Iran-linked cyber espionage surges across Middle East](https://industrialcyber.co/critical-infrastructure/iran-linked-cyber-espionage-surges-across-middle-east-as-conflict-tensions-rise-researchers-say/)
- [Check Point Research: Bad Karma, No Justice — Void Manticore Destructive Activities in Israel](https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/)
- [SOCRadar: Dark Web Profile — Storm-842 (Void Manticore)](https://socradar.io/blog/dark-web-profile-storm-842-void-manticore/)
- [MITRE ATT&CK: MuddyWater (G0069)](https://attack.mitre.org/groups/G0069/)
- [CXO Today: Strategic Intelligence — Decoding Iran's Cyber Capabilities in the 2026 Crisis](https://cxotoday.com/cybersecurity/strategic-intelligence-decoding-irans-cyber-capabilities-in-the-2026-crisis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0215