Check Point VOID MANTICORE Handala Hack March 2026

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.

VOID MANTICORE has used RDP to move laterally within the victim environment.

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.

VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.

VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.

VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.

VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.

VOID MANTICORE has utilized VPS solutions for C2.

VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity. VOID MANTICORE has also leveraged Starlink internet services. VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.

VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.

VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.

VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.