VOID MANTICORE

Names and who uses them

• VOID MANTICOREOur name
• BANISHED KITTENCheck Point
• Red SandstormCheck Point
• COBALT MYSTIQUEMITRE ATT&CK
• Karmabelow80MITRE ATT&CK
• Handala HackUS Department of Justice
• Homeland JusticeUS Department of Justice
• KarmaUS Department of Justice

Targets

Sectors: Government, Critical infrastructure

Regions: United States, Israel

Known techniques

• T1003.001LSASS Memory
• T1005Data from Local System
• T1021.001Remote Desktop Protocol
• T1027.015Compression
• T1036.004Masquerade Task or Service
• T1036.005Match Legitimate Resource Name or Location
• T1041Exfiltration Over C2 Channel
• T1047Windows Management Instrumentation
• T1059.001PowerShell
• T1059.006Python
• T1071.001Web Protocols
• T1072Software Deployment Tools
• T1074Data Staged
• T1078Valid Accounts
• T1078.002Domain Accounts
• T1078.004Cloud Accounts
• T1082System Information Discovery
• T1087.002Domain Account
• T1098Account Manipulation
• T1102Web Service
• T1105Ingress Tool Transfer
• T1110Brute Force
• T1110.001Password Guessing
• T1110.004Credential Stuffing
• T1113Screen Capture
• T1114.002Remote Email Collection
• T1119Automated Collection
• T1123Audio Capture
• T1125Video Capture
• T1133External Remote Services
• T1190Exploit Public-Facing Application
• T1199Trusted Relationship
• T1204.002Malicious File
• T1213.002Sharepoint
• T1219.002Remote Desktop Software
• T1484.001Group Policy Modification
• T1485Data Destruction
• T1486Data Encrypted for Impact
• T1490Inhibit System Recovery
• T1547.001Registry Run Keys / Startup Folder