Storm-842

Storm-842 is Microsoft's designation for an Iranian MOIS-linked threat actor also tracked as Void Manticore, operating under the hacktivist personas Homeland Justice and Karma. The group is primarily known for destructive wiper attacks, deploying custom wiper malware including Cl Wiper, No-Justice (LowEraser), and BiBi against Albania and Israel. In July 2022, Storm-842 deployed ransomware followed by wiper malware against the Albanian government, causing widespread disruption to public services; the attack was retaliation for Albania hosting the Mujahedin-e Khalq (MEK) opposition group. Subsequent waves of attacks struck Albanian organizations in September 2022 and December 2023 under the Homeland Justice banner. After the outbreak of the Israel-Hamas war in October 2023, the group pivoted to attacking Israeli organizations under the Karma persona using the BiBi wiper, which bears technical similarities to the wipers deployed against Albania. Microsoft's investigation identified four distinct Iranian actor groups participating in the Albania operation, with Storm-842 responsible for the final deployment of destructive payloads after earlier actors completed initial access and data exfiltration.