Gangs
K

Karma

Active

VOID MANTICORE · COBALT MYSTIQUE · Handala Hack also known as

Total victims

0

This month

0

Active

—

DayBreach AI intelligence

Gang profile and current news · from web sources

Loading…

How it operates

Karma is a ransomware group first observed in mid-2021, part of a lineage tracing back through Nefilim and FiveHands, operating double-extortion attacks against enterprises in healthcare, manufacturing, and technology; the group was managed by threat actor "farnetwork" who ran multiple RaaS programs across related strains. Platforms: Windows and Linux

T1113 · Screen CaptureT1110.001 · Password GuessingT1119 · Automated CollectionT1561.001 · Disk Content WipeT1486 · Data Encrypted for ImpactT1566 · PhishingT1589 · Gather Victim Identity InformationT1657 · Financial TheftT1102 · Web ServiceT1059.001 · PowerShellT1047 · Windows Management InstrumentationT1484.001 · Group Policy ModificationT1564.003 · Hidden WindowT1583.001 · DomainsT1123 · Audio CaptureT1190 · Exploit Public-Facing ApplicationT1114.002 · Remote Email CollectionT1074 · Data StagedT1078.002 · Domain AccountsT1027.015 · CompressionT1684.001 · ImpersonationT1036.005 · Match Legitimate Resource Name or LocationT1679 · Selective ExclusionT1087.002 · Domain AccountT1588.001 · MalwareT1490 · Inhibit System RecoveryT1072 · Software Deployment ToolsT1003.001 · LSASS MemoryT1651 · Cloud Administration CommandT1583.003 · Virtual Private ServerT1583.006 · Web ServicesT1686.003 · Windows Host FirewallT1552.002 · Credentials in RegistryT1213.002 · SharepointT1219.002 · Remote Desktop SoftwareT1595.002 · Vulnerability ScanningT1561.002 · Disk Structure WipeT1583.004 · ServerT1105 · Ingress Tool TransferT1082 · System Information Discovery

MITRE ATT&CK profile

G1055

[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)

MITRE