Loading threat actor…
Scarred Manticore is an Iranian state-linked threat actor associated with activity overlapping APT34/OilRig and assessed as part of the broader Ministry of Intelligence and Security (MOIS) cyber ecosystem. The actor is consistently characterized as an initial-access and long-dwell espionage cluster that establishes footholds in victim environments, conducts intelligence collection, and in some operations hands access to other Iranian operators for disruptive or destructive follow-on activity, particularly Void Manticore and the Handala persona. Public reporting also correlates Scarred Manticore with Microsoft tracking clusters Storm-0842 and Storm-0861 in the context of paired operations against Israeli targets. The group has targeted government and telecommunications organizations in the Middle East and has been linked to regional espionage activity involving Saudi Arabia, Qatar, Iraq, and Israel. Reporting also notes collaboration with Iranian persona-driven operations including Handala, Homeland Justice, and Karma. In Israeli municipal and other regional intrusions, Scarred Manticore has been described as responsible for the initial compromise and long-term collection phase before a separate actor executed wiper deployment, data leakage, or other disruptive actions. Tradecraft attributed to Scarred Manticore includes exploitation of internet-facing systems, notably Microsoft SharePoint vulnerabilities such as CVE-2019-0604, deployment of host-specific custom implants, use of passive or covert listener-style malware, stealthy command-and-control concealed within normal-looking traffic, and data exfiltration. Kaspersky-linked reporting associates the actor with the LionTail in-memory framework, which abuses undocumented Windows HTTP.sys behavior to covertly deliver payloads. The actor has also been described as generating unique implants per compromised host, emphasizing persistence, low observability, and prolonged access suitable for espionage and operational handoff.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as collaborating with MOIS-linked persona operations within the same broader ecosystem.
Associated with the LionTail framework; creates unique implants per compromised host and exfiltrates data while disguising C2 traffic as normal network traffic.
Associated with LionTail framework activity, generating unique implants per host and conducting stealthy data exfiltration while masking C2 within normal-looking HTTP traffic.
Referenced as the prior access-side actor in an earlier handoff model to Void Manticore/Handala.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.