VOID MANTICORE

VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.^[4][9]

VOID MANTICORE has gathered audio during a Zoom session.^[11]

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.^[4]

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.^[1]

VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.^[2]

VOID MANTICORE has conducted data wiping attacks on compromised systems.^{[1][10][3][2]} VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.^[1][3]

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.^[1][3]

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.^[6][8][7]

VOID MANTICORE has collected cached data and files from within the victim environment.^[10][3][11]

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.^[11]

During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.^[7]

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.^[4]

During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.^[8]

VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.^[3]

For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.^[8]

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.^[1]

VOID MANTICORE has conducted data exfiltration and posted stolen information on data leak sites for the purposes of financial and political extortion.^[10][3] VOID MANTICORE has also sold stolen data to prospective buyers for cryptocurrency.^[3]

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.^[11]

VOID MANTICORE has deployed additional payloads from dedicated C2 servers.^[1][3][11] VOID MANTICORE has also downloaded legitimate tools and software from publicly available services.^[1] VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.^[1]

During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.^[7]

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.^[1]

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.^[8]

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.^[8][7]

VOID MANTICORE has emailed victims threatening messages.^[3] VOID MANTICORE has used phishing as an initial access vector.^[4]

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.^[1]

VOID MANTICORE has captured screen content during an active Zoom session.^[11]

VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.^[11]

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions.^[10][2] VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.^[10][2]

VOID MANTICORE has gathered system information and disseminated it back to C2.^[11]

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.^[1]

VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure.^[1] VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems.^[4] VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.^[1]

During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.^[8]

VOID MANTICORE has collected video from compromised victim devices.^[11]

VOID MANTICORE has utilized Telegram API for C2.^[3][11]

VOID MANTICORE has utilized WMIC to log into the victim host and create a process process call create "cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public".^[1]

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.^[7]