FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has collected cached data and files from within the victim environment.

VOID MANTICORE has compressed their payloads by leveraging zip files.

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.

VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications. VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.

VOID MANTICORE has utilized PowerShell to execute malware in victim environments.

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.

VOID MANTICORE has utilized HTTPS for communication to C2 domains.

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.

VOID MANTICORE has gathered system information and disseminated it back to C2.

VOID MANTICORE has utilized Telegram API for C2.

VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.

VOID MANTICORE has captured screen content during an active Zoom session.

VOID MANTICORE has gathered audio during a Zoom session.

VOID MANTICORE has collected video from compromised victim devices.

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.

VOID MANTICORE has registered domains for messaging purposes. VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion. VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex. VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.

VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.

VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.