apt

Karmabelow80

dormantAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Karma BelowKarmabelow80

Attribution

Online persona, not an independent intrusion set; called 'Karma' (also written 'KarMa') in vendor reporting, with Karmabelow80 as its website name. Assessed as operated by Void Manticore (Iran, MOIS-affiliated) - Medium confidence: Check Point Research says Void Manticore 'likely operates the Karma persona and utilizes access previously obtained by Scarred Manticore'; MITRE ATT&CK lists Karma and Karmabelow80 under VOID MANTICORE (G1055); and the US DOJ describes Karmabelow80[.]org as an official website of 'a shell hacktivist entity used by MOIS', without naming Void Manticore. Claims published under the persona are the operator's own assertions unless independently corroborated.

Origin

Iran (operator assessed)

First seen

2023 (Telegram channel soon after the Israel-Hamas war broke out in October 2023; website launched November 2023, per Check Point Research)

Last active

Unknown - Check Point Research (2026) describes Karma's 'complete disappearance' and assesses the persona was likely completely replaced by Handala

Motivation

Destructive and psychological operations against Israel - wiper attacks and hack-and-leak, presented as 'Anti-Zionist Jewish Hackers'

Attribution confidence

medium

MENA targeting

Israel

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Diamond Model

The four features of this adversary's intrusions under the Diamond Model — adversary, capability, infrastructure, victim — assembled from tracked data; pivot from any vertex to the others.

Adversary3

Who is behind the activity — operator vs. customer.

Karmabelow80Karma BelowKarmabelow80

Capability

Tradecraft, techniques, and tooling the adversary employs.

No techniques or tooling mapped yet.

Infrastructure

Physical/logical infrastructure used to deliver capability (C2, domains, relays).

No infrastructure indicators correlated in Radar yet.

Victim1

Targeting — sectors and geographies in scope.

Israel

Social-political (intent)Destructive and psychological operations against Israel - wiper attacks and hack-and-leak, presented as 'Anti-Zionist Jewish Hackers'

Operator ↔ CustomerOperator (intrusion crew) acting for a Customer (sponsoring interest) — attribution separates the two.

Honesty note

Attribution ≠ confirmation. Karmabelow80 is linked here via TTP overlap and shared infrastructure — not confirmed by original-source reporting. Treat this as a working hypothesis, not a settled fact.

See the analysis →

Analysis of Competing Hypotheses

No competing-hypotheses matrix filed yet

Attribution here rests on the Diamond Model and Kill Chain evidence above. Start a formal ACH matrix to stress-test the leading hypothesis.

Useful?