MITRE ATT&CKgroup
G1059 NIMBUS MANTICORE
- Domain
- enterprise
- Aliases
- UNC1549, TA455, COBALT SMOKEY
- Version
- 1.0
- Created
- 2026-10-01
Description
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.
Related
Uses · MITRE ATT&CK (78)
- S9062 MiniBrowse software (malware)
- S9063 DEEPROOT software (malware)
- S9064 TRUSTTRAP software (malware)
- S9065 DCSYNCER.SLICK software (malware)
- S9066 POLLBLEND software (malware)
- S9067 TWOSTROKE software (malware)
- S9061 LIGHTRAIL software (malware)
- S9057 CRASHPAD software (malware)
- S9058 SIGHTGRAB software (malware)
- S9059 MiniBike software (malware)
- S9060 MiniBus software (malware)
- S9052 MiniFast software (malware)
- S9053 MiniJunk software (malware)
- T1684.001 Impersonation sub-technique
- T1685.003 Modify or Spoof Tool UI sub-technique
- T1683.001 Written Content sub-technique
- T1683.002 Audio-Visual Content sub-technique
- T1678 Delay Execution technique
- T1027.015 Compression sub-technique
- T1213.005 Messaging Applications sub-technique
- T1574.014 AppDomainManager sub-technique
- T1588.007 Artificial Intelligence sub-technique
- T1608.006 SEO Poisoning sub-technique
- T1649 Steal or Forge Authentication Certificates technique
- T1070.007 Clear Network Connection History and Configurations sub-technique
- T1608.001 Upload Malware sub-technique
- T1608.005 Link Target sub-technique
- T1591 Gather Victim Org Information technique
- T1598.001 Spearphishing Service sub-technique
- T1583.003 Virtual Private Server sub-technique
References
- https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/ CheckPoint_NimbusManticoreEurope_Sept2025
- https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/ CheckPoint_NimbusManticore_May2026
- https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense Mandiant_UNC1549TTPsTools_Nov2025
- https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east Mandiant_UNC1549_Feb2024
- https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025
- https://www.sophos.com/en-us/threat-profiles/cobalt-smokey Sophos Iran Cobalt Smokey Nimbus Manticore October 2026