Void Manticore, also known as Handala or Storm-0842/Storm-1084 or COBALT MYSTIQUE is a hacking group based in the Middle East that has claimed responsibility for cyberattacks against Albania, Israel and the U.S. Its name is a reference to Handala, a prominent national symbol and personification of the Palestinian people.
They have claimed responsibility for more than 20 hack-and-leak operations. They have deployed ransomware and DDOS attacks, as well as “wiper” attacks in which massive amounts of data is wiped from servers. They operate under Iran’s Ministry of Intelligence and Security (MOIS) and first surfaced in July 2022 with destructive cyberattacks against Albania’s e-government systems. Their tools involve the use of bespoke wiper malware called Cl Wiper and No-Justice.
"It's not Handala – it's four groups with four different names, and they operate under one intelligence ministry," says Gil Messing, chief of staff at Check Point told Haaretz.
HivePro reports that "It has targeted government agencies and critical infrastructure across Israel, United States, Albania, Jordan, and Gulf States, focusing on sectors including oil and gas, energy, telecommunications, defense, NGOs, media, think tanks, IT service providers, education, transportation, airlines, maritime, and healthcare."
During the 2026 Iran war Void Manticore's Handala persona claimed responsibility for a data-wiping attack against Stryker Corporation, a global medical technology company based in Michigan. Stryker's information systems and business applications were disrupted according to the company's March 11 SEC filing. The U.S. Federal Bureau of Investigation responded by taking down four websites linked to the group.
Handala Hack Group also took credit for hacking into FBI Director Kash Patel's personal email on March 27, 2026.
References