Iranian threat actors carry out destructive wiping attacks on Israel

Iranian threat actor Void Manticore, also known as Storm-842, continues to launch a wave of destructive cyberattacks targeting Israeli organizations. Since its first appearance in late 2023, the group claims to have successfully targeted over 40 Israeli organizations, including several high-value targets. These attacks involve not only wiping data but also stealing and potentially leaking sensitive information.

Void Manticore operates several online personas, with the most prominent among them being Homeland Justice for attacks in Albania and Karmfor attacks carried out in Israel. These personas allow them to tailor their messaging in an attempt to effectively weaponize political tensions

The threat group employs custom data-wiping malware like the "BiBi wiper," named after Israeli Prime Minister Benjamin Netanyahu, to cripple victims in Israel. According to a report by Check Point Research (CPR), BiBi wiper was deployed in several campaigns against multiple entities in Israel and has variants for both Linux and Windows.

An analysis carried out by CPR security researchers reveals a significant overlap in victimology with Scarred Manticore (aka Storm-861), suggesting a collaboration between the two threat groups which extends beyond single operations or incidents. The analysis suggests a coordinated effort, with Scarred Manticore potentially identifying targets and "handing them off" to Void Manticore for destructive attacks.

"The documented handoff procedures between these groups suggest a consistent level of planning and allow Void Manticore access to a wider set of targets, facilitated by their counterparts' advanced capabilities," CPR said.

According to CPR, Void Manticore leverages a set of custom wipers to inflict targeted damage. Some of these wipers target and destroy specific files or file types within the infected systems, corrupting critical information and causing significant disruption to applications, user data, and system functionality.

More details about the techniques, tactics, and procedures (TTPs) employed by Void Manticore are available here.