May 2026

From Threat Report to Detection Scenario: Simulating Iran’s Handala Hack

Why This Scenario Exists

In March 2026, Check Point Research published an in-depth analysis of Handala Hack, the public persona of Void Manticore, an Iranian malicious actor affiliated with the Ministry of Intelligence and Security (MOIS). GBHackers followed up on the report a few days later with operational details on the group’s RDP-heavy intrusions.

Two factors made this group a priority for BlackNoise’s catalogue. Firstly, Handala’s targeting has expanded westwards: whilst Void Manticore historically focused on Israel and Albania, recent intrusions have targeted the US-based medical technology supplier Stryker. Customers who once regarded Iran-linked actors as a regional problem now require protection. Secondly, the methodology is based on widely available techniques – no zero-day exploits, no novel implants. Each step, taken individually, blends into administrative noise. The question this scenario answers is: Does your detection stack correlate the low-noise phases into a single event before the destructive finale is triggered?

The Threat Actor

Handala Hack is the public persona of Void Manticore (also tracked as Red Sandstorm and Banished Kitten), an Iranian actor affiliated with the Ministry of Intelligence and Security (MOIS) who carries out destruction and hack-and-leak operations for the purpose of geopolitical sabotage. Targets include Israel, Albania, US enterprises, and IT/service providers used as supply-chain pivots. The level of sophistication is low to medium, with hands-on operations utilising off-the-shelf tools and ‘living-off-the-land’ techniques. The group’s signature is the deployment of multiple data-wiping methods in parallel via Group Policy Object (GPO) distribution.

The MOA is methodical: VPN credentials are compromised through supply-chain attacks targeting IT providers, followed by a dwell time of several months, then a short pre-impact window during which the actor disables Defender, dumps credentials, runs ADRecon, moves laterally via RDP, and deploys four parallel destructive methods: a custom MBR wiper, an AI-assisted PowerShell wiper, VeraCrypt encryption, and manual VM deletion.

Developing the Scenario: Selection Principles

The Check Point report begins with VPN brute-force attacks and ends with the manual deletion of hypervisors. BlackNoise operates in assume-breach mode: Initial access is out of scope. The scenario begins with Domain Administrator credentials already having been obtained, consistent with the multi-month dwell time documented by Check Point prior to destructive activity.

Two rules guided the selection of events.

  • As each event was linked to a specific quote or IOC from the source, the generic assumption of an Iran connection was rejected.
  • Events are categorised into Tier 1 (verbatim source reference) and Tier 2 (operational prerequisite implied but not cited, such as enabling ‘Restricted Admin’ before carrying out a ‘Pass-the-Hash’ attack over RDP).

Event Selection: The Link to the Source Report

The 18 events are grouped into six phases, each corresponding to a paragraph in the Check Point report.

Two mapping decisions are worth noting.

  • ADRecon coverage: we chained together four discrete Discovery primitives (accounts, groups, computers, dsquery) plus Group Policy Discovery. Together, they replicate the telemetry footprint of a real ADRecon run.
  • Lateral movement: Phase 5 models the preparation, scanning for active RDP listeners, enabling Restricted Admin for PTH-over-RDP, and enabling RDP on hosts where it was previously disabled. The detectable signal arises from these steps, not from the RDP sessions themselves.

What This Scenario Tests

  1. Defender tamper detection. Does the EDR alert on PowerShell-driven ATP and AMSI disable operations?
  2. Correlation between credential dumping. Is LSASS accessible via comsvcs.dll, Shadow Copy hive extraction and SAM dump: should these be viewed as part of a single credential-based attack campaign, or treated as three separate incidents?
  3. Signal-to-noise recognition. Does large-scale Active Directory enumeration – of accounts, groups, computers and GPOs – within minutes trigger a reconnaissance alert, or does it blend in with normal administrative activity?
  4. Pre-impact warning. Does deleting a Volume Shadow Copy via vssadmin trigger pre-emptive wiper/ransomware alerts before file overwriting begins?
  5. Kill-chain correlation. Are these 18 events linked together in a single incident timeline, or do they appear as 18 separate tickets?

The fifth question is the most important. A SOC that detects every event but presents them as separate tickets has recorded Handala didn’t spot it.

Conclusion

Handala Hack is not technically sophisticated, and that is the point. The group succeeds because the kill chain remains hidden amongst administrative noise until the wiper is triggered. Defenders who assess their defences against this scenario are not testing whether they can detect a single exotic technique; they are testing whether they can recognise an ordinary one repeated eighteen times. Run the test, identify where the correlation breaks down, and adjust your defences accordingly.

Sources for this scenario:

“Handala Hack” – Revealing the Group’s Modus Operandi: https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi

Handala Hackers Exploit RDP and NetBird in Coordinated Wiper Attacks: https://gbhackers.com/coordinated-wiper-attacks