Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel

Check Point attributes destructive wiping campaigns against Albania and Israel to an Iranian MOIS‑linked actor tracked as Void Manticore (Storm‑0842), noting use of bespoke wipers (Cl Wiper, No‑Justice/LowEraser, BiBi), exploitation of known internet‑facing flaws, RDP/SMB/FTP lateral movement, web shells (Karma Shell), and operational handoffs with related Iranian clusters such as Storm‑0861.