Iran APTs Tag Team Espionage, Wiper Attacks Against Israel & Albania

This report describes a coordinated operation by Iranian state-linked APTs: Scarred Manticore (espionage via the fileless Liontail framework and email data exfiltration) and Void Manticore (destructive hack-and-leak campaigns and custom wipers). Scarred Manticore establishes stealthy, long-term access—often exploiting CVE-2019-0604—then hands off access to Void Manticore, which uses simple tooling (RDP, reGeorg) and wipers that corrupt files or damage partition tables to cause data loss, with reported campaigns against over 40 Israeli organizations and notable activity targeting Albania.