Check Point Details Handala Hack’s AI-Assisted Wiping Operations
Summary
Check Point Research links Handala Hack to Iranian threat actor Void Manticore and reports AI-assisted PowerShell wiping, NetBird tunneling, and layered destruction. The group has targeted Israel and U.S. organizations, including Stryker.
Key points
- Check Point Research identifies Handala Hack as a persona used by Void Manticore, which it describes as affiliated with Iran’s Ministry of Intelligence and Security.
- The article says Handala has focused on Israel and recently targeted U.S. organizations, including Stryker.
- Researchers report an AI-assisted PowerShell script for wiping and use of NetBird for tunneling and maintaining access.
- Reported destructive methods include simultaneous wiping techniques, disk encryption, and manually deleting files or virtual machines through RDP.
- The article recommends enforcing MFA, restricting RDP, and maintaining offline, immutable backups.
Article Details
- Event Type
- Check Point Research report on destructive hack-and-leak and wiping operations attributed to Void Manticore and its Handala Hack persona.
- Impact
- The reported operations target Israel and U.S. organizations, including Stryker, and have also involved campaigns against Albania. Researchers describe AI-assisted PowerShell wiping scripts, NetBird tunneling, disk encryption, and manual deletion of files and virtual machines, which can leave systems inaccessible or unrecoverable. No specific loss or victim count is reported.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolOperators reportedly use Remote Desktop Protocol (RDP) to move laterally and manually delete files.T1078 · Valid AccountsThe article says compromised credentials are often used for initial access.T1485 · Data DestructionThe article describes wiping attacks and manual deletion of files and virtual machines.T1486 · Data Encrypted for ImpactThe article reports disk encryption used to render systems inaccessible.
Threat Actors
Banished KittenThe article identifies Banished Kitten as another name for Void Manticore, which it links to destructive wiping and hack-and-leak operations.HandalaThe article describes Handala Hack as an online persona used by Void Manticore for destructive operations; Check Point Research also tracks Handala Hack as Void Manticore.Red SandstormThe article identifies Red Sandstorm as another name for Void Manticore, which it links to destructive wiping and hack-and-leak operations.Void ManticoreCheck Point Research attributes destructive wiping and hack-and-leak operations to this Iranian, MOIS-affiliated threat actor.
Tools
Countries
AlbaniaWhile Homeland Justice has been the face of campaigns against Albania since 2022, the Handala persona has focused its sights on Israel and recently expanded to target U.S.-based enterprises, including medical technologyIranAffiliated with Iran’s Ministry of Intelligence and Security (MOIS), this group has built a reputation for high-impact “hack and leak” operations and relentless wiping attacks across the globe.Israelby Iranian threat actor Void Manticore to conduct destructive hack-and-leak and wiping operations against Israel, the US (including Stryker), and other targets.United StatesThe Handala persona has focused on Israel and recently targeted U.S.