Scarred Manticore (Storm-0861) is an MOIS-linked Iranian espionage actor assessed as one of Iran's most sophisticated, known for the stealthy LIONTAIL malware framework and for handing off access to the destructive Void Manticore cluster.
Scarred Manticore was publicly detailed by Check Point Research in 2023 and corresponds to Microsoft's Storm-0861 cluster, one of several Iranian groups tied to destructive operations against the Albanian government. Analysts assess it as MOIS-linked and among Iran's most technically capable espionage actors, prioritizing long-dwell, low-visibility intelligence collection.
The group's signature is the LIONTAIL framework — custom loaders and memory-resident shellcode payloads whose DLL implant abuses undocumented functionality of the Windows HTTP.sys driver to receive commands blended into legitimate web traffic on internet-facing servers. This passive, driver-level C2 makes network detection difficult and supports extended stealthy persistence.
MENA is the group's primary theater. LIONTAIL victims span Saudi Arabia, the UAE, Jordan, Kuwait, Oman, Iraq, and Israel, concentrated in government, telecommunications, military, financial, and IT-services organizations. This victimology maps directly to Iranian regional intelligence priorities.
Scarred Manticore's significance grew with its documented relationship to Void Manticore (Storm-0842): Check Point identified a clear victim 'handoff' in which Scarred Manticore's espionage access precedes Void Manticore's destructive wiper and hack-and-leak operations against Israeli and Albanian targets. Reporting into 2026 continues to link Scarred Manticore to initial-access operations preceding Void Manticore/Handala activity, indicating the group remains an active enabler of Iran's disruptive campaigns.
| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1090 ↗ | Proxy | command and control | Article describes FOXSHELL (based on the open-source Tunna tunnel framework) as allowing connection from outside to any service on the remote host, including firewall-blocked services, by proxying all external communication through the web shell over HTTP. |
| T1071.001 ↗ | Application Layer Protocol: Web Protocols | command and control | LIONTAIL's primary variant is described as a passive backdoor on Windows servers that enables attackers to execute commands remotely through HTTP requests, listening on URL prefixes mimicking legitimate services (e.g. /autodiscover/autodiscovers/, /ews/exchanges/). |
| T1105 ↗ | Ingress Tool Transfer | command and control | Article describes the SDD backdoor's Rundll command type, which loads additional .NET assemblies delivered by the operators, and generally describes downloading/staging of additional tooling to compromised servers. |
| T1095 ↗ | Non-Application Layer Protocol | command and control | Article describes a named-pipe variant of LIONTAIL that uses named pipes (not HTTP) to facilitate remote code execution, with a security descriptor granting File All Access to everyone. |
| T1572 ↗ | Protocol Tunneling | command and control | Article describes FOXSHELL's proxy behavior (opening a new socket to a remote machine specified in its configuration, or relaying Data-type packages) as tunneling arbitrary service traffic through the web shell's HTTP channel. |
| T1562.002 ↗ | Impair Defenses: Disable Windows Event Logging | defense evasion | Article states FOXSHELL version 1.7 includes an Event Log bypass using a known technique of suspending EventLog Service threads. |
| T1014 ↗ | Rootkit | defense evasion | Article describes WINTAPIX as a kernel-mode driver used to enumerate user-mode processes and inject shellcode from kernel level, consistent with kernel-mode rootkit-enabling functionality. |
| T1036.005 ↗ | Masquerading: Match Legitimate Resource Name or Location | defense evasion | Article states implants attempt to disguise the executable as Cyvera Console, a component of Cortex XDR. |
| T1027.002 ↗ | Obfuscated Files or Information: Software Packing | defense evasion | Article describes web shell variants (e.g. the compiled-DLL FOXSHELL) with class and method obfuscation, and payload/URL generation that inserts random dictionary words into paths so malware communication blends into legitimate traffic. |
| T1027.013 ↗ | Obfuscated Files or Information: Encrypted/Encoded File | defense evasion | Article describes payloads that are base64-decoded and then decrypted by XORing the data with the first byte (or a randomly chosen prepended key byte for responses); web shell variants use the same XOR/base64 scheme with additional class/method/string obfuscation. |
| T1518 ↗ | Software Discovery | discovery | Article describes the SDD backdoor using the .NET ServerManager class to extract the list of sites hosted by IIS in order to build a matching set of URL prefixes to listen on. |
| T1082 ↗ | System Information Discovery | discovery | Article describes a machine-fingerprinting payload gathering Computer Name, Domain Name, 64-bit flag, number of processors, physical RAM, and data from CurrentVersion, SecureBoot\State, and System\Bios registry keys. |
| T1059.003 ↗ | Command and Scripting Interpreter: Windows Command Shell | execution | Article describes the SDD backdoor executing base64-decoded commands via cmd /c when it receives a POST request containing a specific trigger string. |
| T1055 ↗ | Process Injection | execution | Article describes LIONTAIL creating a new thread and running received shellcode in memory, and separately describes the WINTAPIX kernel driver injecting Donut-generated shellcode into a found user-mode process running with local system privileges. |
| T1041 ↗ | Exfiltration Over C2 Channel | exfiltration | Article describes the SDD backdoor's Download command sending a specified file to the threat actors over the same C2 channel, and references historical email exfiltration from Exchange/EWS access across Kuwait, Saudi Arabia, Turkey, UAE, and Jordan. |
| T1190 ↗ | Exploit Public-Facing Application | initial access | Check Point reporting ties Scarred Manticore's Albania intrusion to exploitation of an Internet-facing Microsoft SharePoint server; article also generally references exploitation of publicly facing servers as an access vector. |
| T1090.002 ↗ | Proxy: External Proxy | lateral movement, exfiltration | Article describes the LIONHEAD web forwarder deployed on Exchange servers, which forwards request content type, cookie, and body to a configured forward_server/forward_path/forward_port, used to reach Exchange Web Services (EWS) endpoints while concealing the true external consumer of the data. |
| T1505.003 ↗ | Server Software Component: Web Shell | persistence | Article details a lineage of web shells (Tunna-based, FOXSHELL versions XORO/Bsae64/compiled-DLL, an XSL transform web shell, and an SDD .NET web-based backdoor) deployed on compromised servers for persistent access. |
| T1543.003 ↗ | Create or Modify System Process: Windows Service | persistence | Article describes enabling specific Windows services (e.g. IKE and AuthIP IPsec Keying Modules, Extensible Authentication Protocol) via commands like sc.exe config Eaphost start=auto to trigger the hijacked DLL's loading at boot. |
| T1574.001 ↗ | Hijack Execution Flow: DLL Search Order Hijacking | persistence, privilege escalation | Article describes malicious DLLs dropped to C:\windows\system32 using names not present by default on Windows Server (e.g. wlanapi.dll, wlbsctrl.dll) to be side-loaded by legitimate services. |