Check Point Details Handala Hack’s Intrusion and Destructive Tactics
Summary
Check Point Research links Handala Hack to Void Manticore and details observed intrusions using compromised VPN credentials, RDP and NetBird, followed by parallel wiper, MBR-corruption and VeraCrypt destruction; it recommends MFA and tighter remote access controls.
Key points
- Check Point Research identifies Handala Hack as a persona operated by Void Manticore, also known as Red Sandstorm and Banished Kitten, which it describes as affiliated with Iran’s MOIS.
- The report describes VPN credentials as a common initial-access method, with brute-force attempts and credential theft observed; in one intrusion, network access may have preceded destructive activity by months.
- Operators used RDP for hands-on lateral movement and manually deployed NetBird to connect internal hosts; researchers observed at least five attacker-controlled machines operating simultaneously in one environment.
- Group Policy and logon scripts distributed multiple destructive tools, including a custom Handala wiper and a PowerShell wiper that deleted user files; the custom wiper also used MBR corruption.
- Researchers observed the use of VeraCrypt to encrypt system drives, as well as manual deletion of files and virtual machines, alongside other wiping activity.
- The report says indicators can be short-lived and recommends MFA, monitoring suspicious authentication, and restricting or hardening VPN and RDP access.
Article Details
- Attack Vectors
- Initial access through compromised VPN accounts, with repeated brute-force and logon attempts also observed against organizational VPN infrastructure.
- Targeting of IT and service providers to obtain credentials and access.
- Credential extraction through LSASS dumping with rundll32.exe and comsvcs.dll, and export of sensitive registry hives.
- Lateral movement over RDP; NetBird was manually installed on multiple compromised machines to create internal connectivity.
- Destructive payloads were distributed using Group Policy logon scripts and scheduled tasks. The operations included a custom file and MBR wiper, a PowerShell file-deletion wiper, VeraCrypt disk encryption, and manual deletion of virtual machines and files.
- Defensive Notes
- Enforce MFA, especially for remote access and privileged accounts, and monitor for suspicious authentication patterns, repeated failures followed by success, new devices, and unusual VPN data transfers.
- Restrict VPN access by geography and infrastructure where feasible; apply conditional access and enhanced monitoring for Starlink and other high-risk ranges.
- Restrict and harden RDP, disable it where unnecessary, and investigate access from systems using default DESKTOP- or WIN-style hostnames, especially outside normal working hours.
- Monitor for NetBird, tunneling utilities, and other potentially unwanted remote-management software.
- Monitor for suspicious Group Policy and logon-script changes, scheduled wiper execution, credential extraction, and destructive disk or file activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 107[.]189[.]19[.]52 | Dedicated command-and-control server from which the attacker attempted to retrieve an additional payload. |
| IPV4 | 146[.]185[.]219[.]235 | VPN exit node observed in use by Handala; the article assesses it as linked to a VPN service. |
| IPV4 | 31[.]57[.]35[.]223 | IP address identified in the article as a Handala VPS. |
| IPV4 | 82[.]25[.]35[.]25 | IP address identified in the article as a Handala VPS. |
| MD5 | 3236facc7a30df4ba4e57fddfba41ec5 | Hash of the VeraCrypt installer that the attackers downloaded and used for disk encryption. |
| MD5 | 3cb9dea916432ffb8784ac36d1f2d3cd | Hash identified in the article as the Handala PowerShell Wiper. |
| MD5 | 3dfb151d082df7937b01e2bb6030fe4a | Hash of the NetBird installer that the attackers downloaded and deployed on compromised systems. |
| MD5 | 5986ab04dd6b3d259935249741d3eff2 | Hash identified in the article as the Handala Wiper. |
| MD5 | e035c858c1969cffc1a4978b86e90a30 | Hash listed for NetBird, which the attackers deployed to create internal connectivity between compromised machines. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe attacker dumped LSASS using rundll32.exe and comsvcs.dll to extract credentials.T1021.001 · Remote Desktop ProtocolThe operators used RDP extensively to move between compromised systems.T1037.003 · Network Logon ScriptGroup Policy logon scripts triggered the destructive components and propagated them across systems.T1047 · Windows Management InstrumentationWMIC was used to run a remote command during the intrusion.T1053.005 · Scheduled TaskThe Handala wiper was distributed as a scheduled task.T1059.001 · PowerShellAn AI-assisted PowerShell wiper enumerated and deleted files in users' directories.T1078.002 · Domain AccountsThe operators used compromised credentials, including Domain Administrator credentials, within victim networks.T1087.002 · Domain AccountADRecon, named dra.ps1, was used to enumerate Active Directory accounts and the environment.T1110 · Brute ForceRepeated brute-force and logon attempts were observed against organizational VPN infrastructure.T1133 · External Remote ServicesThe group used compromised VPN access to enter victim environments.T1484.001 · Group Policy ModificationGroup Policy was used to distribute the different wipers across the network.T1485 · Data DestructionThe operators deleted files and virtual machines, and deployed wipers that overwrote or removed files.T1486 · Data Encrypted for ImpactThe attackers used VeraCrypt to encrypt system drives as part of the destructive operation.T1561.002 · Disk Structure WipeThe custom Handala wiper used MBR-based techniques to corrupt or destroy disk structures.T1572 · Protocol TunnelingNetBird was deployed to tunnel traffic and connect to internal hosts.
People
Threat Actors
Banished KittenThe article identifies Banished Kitten as another name for Void Manticore, which it links to destructive wiping and hack-and-leak operations.Red SandstormThe article identifies Red Sandstorm as another name for Void Manticore, which it links to destructive wiping and hack-and-leak operations.Scarred ManticoreThe article describes Scarred Manticore as a separate Iranian threat actor that collaborated with Karma and Homeland Justice.Void ManticoreThe article identifies Void Manticore as an Iranian MOIS-affiliated actor responsible for destructive wiping and hack-and-leak operations targeting organizations in Israel, Albania, and the United States.
Malware
Handala PowerShell Wiper[File Hashes ] Wipers and installers observed in incidents – 5986ab04dd6b3d259935249741d3eff2 (Handala Wiper), 3cb9dea916432ffb8784ac36d1f2d3cd (Handala PowerShell Wiper), and 3 more hashes.Handala Wiperfor lateral movement, and deploys multiple concurrent destructive techniques including a custom Handala wiper, an AIâassisted PowerShell wiper, MBR corruption, and VeraCrypt disk encryption.
Products
NetBirdThe group conducts handsâon intrusions using compromised VPN credentials, RDP and NetBird for lateral movement, and deploys multiple concurrent destructive techniques including a custom Handala wiper, an AIâassistedVeraCrypttechniques including a custom Handala wiper, an AIâassisted PowerShell wiper, MBR corruption, and VeraCrypt disk encryption.Windows DefenderThe actor disabled Windows Defender protections and executed multiple reconnaissance and credential-theft operations.
Tools
Countries
Albaniaresponsible for multiple destructive wiping and hackâandâleak operations against targets in Israel, Albania, and the United States.IranHandala Hack is a persona of Void Manticore (aka Red Sandstorm, Banished Kitten), an actor affiliated with Iran’s MOIS, operating alongside other personas such as Karma and Homeland Justice.Israelactor responsible for multiple destructive wiping and hackâandâleak operations against targets in Israel, Albania, and the United States.United Statesdestructive wiping and hackâandâleak operations against targets in Israel, Albania, and the United States.
Industries
Governmentamong them being Homeland Justice, maintained from mid-2022 specifically for multiple attacks against government, telecom, and other sectors in Albania, as well as Handala Hack, which has been responsible forIT and service providers[T1199 ] Trusted Relationship – Targeting of IT and service providers to obtain credentials and persistent access.medical technologymultiple intrusions in Israel and recently expanding its targeting to US-based enterprises such as medical technology giant Stryker.