Procedure examples

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.

VOID MANTICORE has collected cached data and files from within the victim environment.

VOID MANTICORE has used RDP to move laterally within the victim environment.

VOID MANTICORE has compressed their payloads by leveraging zip files.

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.

VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications. VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.

VOID MANTICORE has utilized HTTPS for communication to C2 domains.

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.

VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.

VOID MANTICORE has gathered system information and disseminated it back to C2.

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.

VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.

VOID MANTICORE has utilized Telegram API for C2.

VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.

VOID MANTICORE has conducted password guessing to gain initial access.

VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.

VOID MANTICORE has captured screen content during an active Zoom session.

VOID MANTICORE has gathered victim email-content from victim servers.

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.

VOID MANTICORE has gathered audio during a Zoom session.

VOID MANTICORE has collected video from compromised victim devices.

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.

VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.

VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.

VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.

VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers. VOID MANTICORE has also utilized legitimate remote disk wiping commands.

VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.

VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector.

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.

VOID MANTICORE has registered domains for messaging purposes. VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion. VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex. VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.

VOID MANTICORE has utilized VPS solutions for C2.

VOID MANTICORE has leveraged backend servers within Iran.