Scarred Manticore (Storm-0861) is an MOIS-linked Iranian espionage actor assessed as one of Iran's most sophisticated, known for the stealthy LIONTAIL malware framework and for handing off access to the destructive Void Manticore cluster.
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
Scarred Manticore was publicly detailed by Check Point Research in 2023 and corresponds to Microsoft's Storm-0861 cluster, one of several Iranian groups tied to destructive operations against the Albanian government. Analysts assess it as MOIS-linked and among Iran's most technically capable espionage actors, prioritizing long-dwell, low-visibility intelligence collection.
The group's signature is the LIONTAIL framework — custom loaders and memory-resident shellcode payloads whose DLL implant abuses undocumented functionality of the Windows HTTP.sys driver to receive commands blended into legitimate web traffic on internet-facing servers. This passive, driver-level C2 makes network detection difficult and supports extended stealthy persistence.
MENA is the group's primary theater. LIONTAIL victims span Saudi Arabia, the UAE, Jordan, Kuwait, Oman, Iraq, and Israel, concentrated in government, telecommunications, military, financial, and IT-services organizations. This victimology maps directly to Iranian regional intelligence priorities.
Scarred Manticore's significance grew with its documented relationship to Void Manticore (Storm-0842): Check Point identified a clear victim 'handoff' in which Scarred Manticore's espionage access precedes Void Manticore's destructive wiper and hack-and-leak operations against Israeli and Albanian targets. Reporting into 2026 continues to link Scarred Manticore to initial-access operations preceding Void Manticore/Handala activity, indicating the group remains an active enabler of Iran's disruptive campaigns.
+16 more relationships — see the relationships browser.