1. Home
  2. Groups
  3. NIMBUS MANTICORE

NIMBUS MANTICORE

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.[1][2][3][4]

ID: G1059
ⓘ
Associated Groups: UNC1549, TA455, COBALT SMOKEY
Version: 1.0
Created: 01 October 2026
Last Modified: 05 October 2026
Version Permalink

Associated Group Descriptions

Name Description
UNC1549

[1][4]

TA455

[5]
COBALT SMOKEY

[6]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1087 .001 Account Discovery: Local Account

NIMBUS MANTICORE has identified logged in users on victim hosts using quser.exe and wmic.exe.[1]

.002 Account Discovery: Domain Account

NIMBUS MANTICORE has enumerated user accounts and group memberships using net user and net group.[1]

NIMBUS MANTICORE also leveraged the legitimate tool AD Explorer to query Active Directory.[1]

Enterprise T1098 Account Manipulation

NIMBUS MANTICORE has reset passwords of valid accounts to include domain accounts in order to obtain persistence and escalate privileges.[1]

NIMBUS MANTICORE has reset passwords for domain controller accounts using net.exe through the command net user DC-01$ P@ssw0rd.[1]

NIMBUS MANTICORE has also abused Resource-Based Constrained Delegation (RBCD) assignments to impersonate high-privileged users and gain unauthorized access to services and resources.[1]

Enterprise T1583 .001 Acquire Infrastructure: Domains

NIMBUS MANTICORE has created fake domains that imitate legitimate brands and services.[3][4][1]

.003 Acquire Infrastructure: Virtual Private Server

NIMBUS MANTICORE has utilized Azure C2 subdomains that resemble *[.]*[.]cloudapp[.]azure[.]com.[4][1]

NIMBUS MANTICORE also utilized services that would reflect the geolocation of their targeted victims.[4]

.006 Acquire Infrastructure: Web Services

NIMBUS MANTICORE has utilized the OnlyOffice platform to deliver malicious payloads to victims.[2]

NIMBUS MANTICORE has utilized webservices in attempts to provide a sense of legitimacy to its infrastructure to include *[.]azurewebsites[.]net.[2][3][4][1]

NIMBUS MANTICORE has also utilized Cloudflare.[3]

Enterprise T1071 Application Layer Protocol

NIMBUS MANTICORE has leveraged reverse SSH shells for command and control.[1]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

NIMBUS MANTICORE has utilized auto-run registry keys to execute benign Windows executables that trigger the execution of a malicious payload.[3][4]

Enterprise T1110 .003 Brute Force: Password Spraying

NIMBUS MANTICORE has conducted password spraying attacks against victim environments.[1]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

NIMBUS MANTICORE has leveraged PowerShell scripts to execute commands in the victim environment.[1]

.007 Command and Scripting Interpreter: JavaScript

NIMBUS MANTICORE has used React templates to generate impersonated branded websites that deliver malicious payloads to victims.[3]

Enterprise T1136 .001 Create Account: Local Account

NIMBUS MANTICORE has created rogue accounts within the compromised environments.[1]

Enterprise T1213 Data from Information Repositories

NIMBUS MANTICORE has gathered data from internal service ticketing systems to include credentials.[1]

.002 Sharepoint

NIMBUS MANTICORE has downloaded files from SharePoint services.[1]

.005 Messaging Applications

NIMBUS MANTICORE has browsed Microsoft Teams and downloaded files.[1]

Enterprise T1039 Data from Network Shared Drive

NIMBUS MANTICORE has collected data from SMB shares within the victim network.[1]

Enterprise T1678 Delay Execution

NIMBUS MANTICORE has planted backdoors that beacon silently for long-term persistence, activating them again after the victim has attempted eradication.[1]

Enterprise T1587 .001 Develop Capabilities: Malware

NIMBUS MANTICORE has generated custom malware.[2][3][4][1]  

NIMBUS MANTICORE has incorporated AI-generated code in its malware development.[2]

Enterprise T1685 .003 Disable or Modify Tools: Modify or Spoof Tool UI

NIMBUS MANTICORE has prompted victims with fake warnings and error messages to appear as legitimate failures to reduce user suspicion.[2][3][4]

Enterprise T1114 .001 Email Collection: Local Email Collection

NIMBUS MANTICORE has reviewed older emails within compromised inboxes to aid in crafting custom email lures.[1]

Enterprise T1585 .001 Establish Accounts: Social Media Accounts

NIMBUS MANTICORE has leveraged social media accounts to correspond with victims.[4]

Enterprise T1591 Gather Victim Org Information

NIMBUS MANTICORE has gathered details on victims to ensure they target members of organizations within software or aviation.[2]

Enterprise T1683 .001 Generate Content: Written Content

NIMBUS MANTICORE has created career-themed phishing lures to entice victims.[2][4]

.002 Generate Content: Audio-Visual Content

NIMBUS MANTICORE has generated fictitious job-related themed websites that entice users to interact and launch malicious actions.[3][4]

NIMBUS MANTICORE has also utilized decoy documents and files to provide a sense of legitimacy to the user.[4]

NIMBUS MANTICORE has leveraged fake Microsoft Outlook login windows prompts to entice victims to enter their credentials.[1]

Enterprise T1574 .001 Hijack Execution Flow: DLL

NIMBUS MANTICORE has leveraged DLL search order hijacking and DLL sideloading to execute malicious payloads.[4][1][3]

.014 Hijack Execution Flow: AppDomainManager

NIMBUS MANTICORE has leveraged AppDomain Hijacking facilitated through a trojanized .config file.[2]

Enterprise T1070 .004 Indicator Removal: File Deletion

NIMBUS MANTICORE has deleted files after successful actions.[1]

.007 Indicator Removal: Clear Network Connection History and Configurations

NIMBUS MANTICORE has cleared RDP connection history registry keys to include HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default and HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers.[1]

Enterprise T1105 Ingress Tool Transfer

NIMBUS MANTICORE has transferred and deployed malware to compromised hosts using remove management services, such as Atelier Web Remote Commander (AWRC), and SSH reverse tunnels.[1]

Enterprise T1534 Internal Spearphishing

NIMBUS MANTICORE has conducted internal spearphishing attacks against IT staff and administrators.[1]

Enterprise T1036 .004 Masquerading: Masquerade Task or Service

NIMBUS MANTICORE has masqueraded as legitimate services.[2]

.005 Masquerading: Match Legitimate Resource Name or Location

NIMBUS MANTICORE has masqueraded as legitimate software.[2]

NIMBUS MANTICORE has also mimicked legitimate installers to include Zoom.[2]

Enterprise T1106 Native API

NIMBUS MANTICORE has utilized Native Windows API calls to execute on victim devices to include GetModuleHandle.[3]

Enterprise T1046 Network Service Discovery

NIMBUS MANTICORE has utilized PowerShell scripts to conduct ping and port scanning of victim subnets.[1]

Enterprise T1027 Obfuscated Files or Information

NIMBUS MANTICORE has utilized a mix of obfuscation techniques to hamper analysis of custom malware.[3]

.015 Compression

NIMBUS MANTICORE has leveraged compressed archives to deliver malicious payloads to include zip files.[2][3][4]

Enterprise T1588 .002 Obtain Capabilities: Tool

NIMBUS MANTICORE has leveraged legitimate tools and publicly available utilities to include AD Explorer.[1]

.003 Obtain Capabilities: Code Signing Certificates

NIMBUS MANTICORE has obtained and utilized valid digital signatures via SSL[.]com.[2][3][1]

.007 Obtain Capabilities: Artificial Intelligence

NIMBUS MANTICORE has appeared to have leveraged AI to assist in malware generation due to coding patterns and modular code organization.[2]

Enterprise T1003 .006 OS Credential Dumping: DCSync

NIMBUS MANTICORE has utilized DCSync to obtain NTLM password hashes for domain users.[1]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

NIMBUS MANTICORE has used spearphishing emails with malicious attachments to entice victims.[1]

.002 Phishing: Spearphishing Link

NIMBUS MANTICORE has utilized malicious links in phishing emails that direct users to download a malicious payload.[2][3][4][1]

Enterprise T1598 .001 Phishing for Information: Spearphishing Service

NIMBUS MANTICORE has corresponded and disseminated links to victims through social media.[4]

Enterprise T1057 Process Discovery

NIMBUS MANTICORE has enumerated active processes using remote management services to include Atelier Web Remote Commander (AWRC).[1]

Enterprise T1563 .002 Remote Service Session Hijacking: RDP Hijacking

NIMBUS MANTICORE has conducted RDP session hijacking to gain access to victim devices.[1]

Enterprise T1021 .001 Remote Services: Remote Desktop Protocol

NIMBUS MANTICORE has utilized RDP to log into victim devices using compromised user credentials.[1]

.002 Remote Services: SMB/Windows Admin Shares

NIMBUS MANTICORE has accessed SMB shares within the victim network to gather and exfiltrate data.[1]

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

NIMBUS MANTICORE has created scheduled tasks to maintain persistence.[3]

Enterprise T1684 .001 Social Engineering: Impersonation

NIMBUS MANTICORE has impersonated legitimate companies with fake career opportunities.[2][3][4][1]

Enterprise T1072 Software Deployment Tools

NIMBUS MANTICORE has utilized commercial remote access tools such as Atelier Web Remote Commander (AWRC) and Microsoft System Center Configuration Manager (SCCM) within victim environments.[1]

Enterprise T1608 .001 Stage Capabilities: Upload Malware

NIMBUS MANTICORE has staged malicious payloads on actor-controlled infrastructure for download to the victim environment.[2][3][4][1]

.005 Stage Capabilities: Link Target

NIMBUS MANTICORE had registered domains that would point to a typo-squatted domain used to deliver malicious payloads.[2]

NIMBUS MANTICORE has also pre-shared credentials with a link to spoofed phishing login pages that enable the download of malicious payloads when authorized credentials are used.[3][1]
.006 Stage Capabilities: SEO Poisoning

NIMBUS MANTICORE has utilized Search Engine Optimization (SEO) poisoning to deliver malware to unsuspecting victims.[2]

NIMBUS MANTICORE has also registered dozens of domains that link to a typosquatted domain to generate link-based reputation signals and incorporated keyword stuffing to improve search ranking.[2]

Enterprise T1649 Steal or Forge Authentication Certificates

NIMBUS MANTICORE has stolen and leveraged vulnerable Active Directory Certificate Services templates to impersonate higher-privileged user accounts.[1]

Enterprise T1558 .003 Steal or Forge Kerberos Tickets: Kerberoasting

NIMBUS MANTICORE has also performed Kerberoasting for credential access using an obfuscated Invoke-Kerberroast.[1]

Enterprise T1049 System Network Connections Discovery

NIMBUS MANTICORE has enumerated existing RDP sessions using remote management services to include Atelier Web Remote Commander (AWRC).[1]

Enterprise T1007 System Service Discovery

NIMBUS MANTICORE has identified running services using remote management services to include Atelier Web Remote Commander (AWRC).[1]

Enterprise T1199 Trusted Relationship

NIMBUS MANTICORE has gained access to victim environments using trusted connections granted to third party partners, collaborators and contractors.[1]

NIMBUS MANTICORE has also leveraged trusted third-party services to include Citrix, VMware, Azure Virtual Desktop and Application Services to gain access to victim networks.[1]

Enterprise T1552 Unsecured Credentials

NIMBUS MANTICORE has obtained credentials from internal service ticketing systems.[1]

Enterprise T1204 .001 User Execution: Malicious Link

NIMBUS MANTICORE has enticed victims to click on links delivered in phishing campaigns.[2][3][4][1]

.002 User Execution: Malicious File

NIMBUS MANTICORE has distributed malicious payloads by enticing users to open or run the executables contained within zip files.[2][3][4][1]

Enterprise T1078 .002 Valid Accounts: Domain Accounts

NIMBUS MANTICORE has leveraged domain accounts for lateral movement and privilege escalation.[1]

.003 Valid Accounts: Local Accounts

NIMBUS MANTICORE has leveraged valid accounts belonging to victim organizations to include those belonging to their trusted partners for initial access and lateral movement.[1]

.004 Valid Accounts: Cloud Accounts

NIMBUS MANTICORE has gained access to Azure AD Connect accounts to modify permissions and to create accounts for persistence.[1]

Enterprise T1047 Windows Management Instrumentation

NIMBUS MANTICORE has leveraged wmic.exe to enumerate logged in users on compromised devices.[1]

Software

ID Name References Techniques
S9057 CRASHPAD CRASHPAD  has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Access Token Manipulation: Token Impersonation/Theft, Credentials from Password Stores: Credentials from Web Browsers, Deobfuscate/Decode Files or Information, Native API
S9065 DCSYNCER.SLICK DCSYNCER.SLICK has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Data from Local System, Data Staged: Local Data Staging, Hijack Execution Flow: DLL, Masquerading: Match Legitimate Resource Name or Location, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information: Dynamic API Resolution, OS Credential Dumping: DCSync
S9063 DEEPROOT DEEPROOT has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Command and Scripting Interpreter: Unix Shell, Data Encoding: Standard Encoding, Delay Execution, Exfiltration Over C2 Channel, Fallback Channels, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, System Information Discovery, System Owner/User Discovery
S9061 LIGHTRAIL LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[4][1] Application Layer Protocol: Web Protocols, Data Obfuscation: Protocol or Service Impersonation, Hijack Execution Flow: DLL, Masquerading: Browser Fingerprint, Native API, Protocol Tunneling, Proxy: External Proxy
S9059 MiniBike MiniBike has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[4] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Data from Local System, Exfiltration Over C2 Channel, File and Directory Discovery, Hijack Execution Flow: DLL, Ingress Tool Transfer, Obfuscated Files or Information: Compression, System Information Discovery
S9062 MiniBrowse MiniBrowse has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[3] Application Layer Protocol: Web Protocols, Browser Information Discovery, Command and Scripting Interpreter: JavaScript, Credentials from Password Stores: Credentials from Web Browsers, Exfiltration Over C2 Channel, Inter-Process Communication, Obfuscated Files or Information: Junk Code Insertion, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information, Permission Groups Discovery: Domain Groups, System Owner/User Discovery
S9060 MiniBus MiniBus has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[4] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Hijack Execution Flow: DLL, Ingress Tool Transfer, Process Discovery, Software Discovery: Security Software Discovery, Virtual Machine Discovery, Virtualization/Sandbox Evasion: System Checks
S9052 MiniFast MiniFast has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[2] Access Token Manipulation: Create Process with Token, Application Layer Protocol: Web Protocols, Archive Collected Data: Archive via Utility, Command and Scripting Interpreter: Windows Command Shell, Data Encoding: Standard Encoding, Data from Local System, Data Staged: Local Data Staging, Deobfuscate/Decode Files or Information, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Local Storage Discovery, Masquerading: Browser Fingerprint, Obfuscated Files or Information: Compression, Process Discovery, Scheduled Task/Job: Scheduled Task, Service Stop, Subvert Trust Controls: Code Signing, System Information Discovery, System Owner/User Discovery
S9053 MiniJunk MiniJunk has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[3] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Data Staged: Local Data Staging, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Native API, Obfuscated Files or Information: Junk Code Insertion, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information: Compression, Obfuscated Files or Information, Process Discovery, Subvert Trust Controls: Code Signing, System Information Discovery, System Owner/User Discovery
S9066 POLLBLEND POLLBLEND has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Application Layer Protocol: Web Protocols, Exfiltration Over C2 Channel, Hijack Execution Flow: DLL, Ingress Tool Transfer, Subvert Trust Controls: Code Signing
S9058 SIGHTGRAB SIGHTGRAB has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Automated Collection, Data from Local System, Data Staged: Local Data Staging, Deobfuscate/Decode Files or Information, Native API, Obfuscated Files or Information: Encrypted/Encoded File, Screen Capture, System Time Discovery
S9064 TRUSTTRAP TRUSTTRAP has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Data Staged: Local Data Staging, Input Capture: GUI Input Capture, Social Engineering: Impersonation
S9067 TWOSTROKE TWOSTROKE has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[7] Command and Scripting Interpreter: Windows Command Shell, Data Encoding: Standard Encoding, Encrypted Channel: Asymmetric Cryptography, Exfiltration Over C2 Channel, File and Directory Discovery, Hijack Execution Flow: DLL, Indicator Removal: File Deletion, Ingress Tool Transfer, Native API, Obfuscated Files or Information: Encrypted/Encoded File, Subvert Trust Controls: Code Signing, System Information Discovery, System Owner/User Discovery

References

  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.
  2. Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.
  3. Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.
  4. Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.
  1. Saher Naumaan and The Proofpoint Threat Research Team. (2025, November 5). Crossed wires: a case study of Iranian espionage and attribution. Retrieved October 5, 2026.
  2. Sophos. (2026, October 5). Iran COBALT SMOKEY. Retrieved October 5, 2026.
  3. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.