Handala Hackers Exploit RDP and NetBird in Coordinated Wiper Attacks

Handala Hack (aka Void Manticore) is a MOIS-linked Iranian destructive actor that obtains long-term VPN/credential access, uses RDP and manually deployed NetBird mesh networking for lateral movement, and simultaneously deploys multiple wiping techniques (custom wiper binary, AI-assisted PowerShell wiper, and VeraCrypt encryption) to rapidly devastate networks; the report details observed TTPs, multiple IOCs (hashes, IPs, ranges), and prioritized defensive mitigations such as enforcing MFA, hardening RDP, and monitoring for large-scale PowerShell deletions and Group Policy changes.