{"description": "Enterprise techniques used by NIMBUS MANTICORE, ATT&CK group G1059 (v1.0)", "name": "NIMBUS MANTICORE (G1059)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1087", "showSubtechniques": true}, {"techniqueID": "T1087.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has identified logged in users on victim hosts using `quser.exe` and `wmic.exe`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1087.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has enumerated user accounts and group memberships using `net user` and `net group`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) also leveraged the legitimate tool AD Explorer to query Active Directory.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1098", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has reset passwords of valid accounts to include domain accounts in order to obtain persistence and escalate privileges.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)     \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has reset passwords for domain controller accounts using `net.exe` through the command `net user DC-01$ P@ssw0rd`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also abused Resource-Based Constrained Delegation (RBCD) assignments to impersonate high-privileged users and gain unauthorized access to services and resources.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1583", "showSubtechniques": true}, {"techniqueID": "T1583.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has created fake domains that imitate legitimate brands and services.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1583.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized Azure C2 subdomains that resemble `*[.]*[.]cloudapp[.]azure[.]com`.(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) also utilized services that would reflect the geolocation of their targeted victims.(Citation: Mandiant_UNC1549_Feb2024)         ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1583.006", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized the OnlyOffice platform to deliver malicious payloads to victims.(Citation: CheckPoint_NimbusManticore_May2026)\n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized webservices in attempts to provide a sense of legitimacy to its infrastructure to include *[.]azurewebsites[.]net.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)      \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also utilized Cloudflare.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1071", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged reverse SSH shells for command and control.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1547", "showSubtechniques": true}, {"techniqueID": "T1547.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized auto-run registry keys to execute benign Windows executables that trigger the execution of a malicious payload.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)        ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1110", "showSubtechniques": true}, {"techniqueID": "T1110.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has conducted password spraying attacks against victim environments.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged PowerShell scripts to execute commands in the victim environment.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.007", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has used React templates to generate impersonated branded websites that deliver malicious payloads to victims.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1136", "showSubtechniques": true}, {"techniqueID": "T1136.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has created rogue accounts within the compromised environments.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1213", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gathered data from internal service ticketing systems to include credentials.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1213.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has downloaded files from SharePoint services.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1213.005", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has browsed Microsoft Teams and downloaded files.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1039", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has collected data from SMB shares within the victim network.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1678", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has planted backdoors that beacon silently for long-term persistence, activating them again after the victim has attempted eradication.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1587", "showSubtechniques": true}, {"techniqueID": "T1587.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has generated custom malware.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)\u00a0\u00a0\n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has incorporated AI-generated code in its malware development.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1685", "showSubtechniques": true}, {"techniqueID": "T1685.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has prompted victims with fake warnings and error messages to appear as legitimate failures to reduce user suspicion.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)         ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1114", "showSubtechniques": true}, {"techniqueID": "T1114.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has reviewed older emails within compromised inboxes to aid in crafting custom email lures.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1585", "showSubtechniques": true}, {"techniqueID": "T1585.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged social media accounts to correspond with victims.(Citation: Mandiant_UNC1549_Feb2024)          ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1591", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gathered details on victims to ensure they target members of organizations within software or aviation.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1683", "showSubtechniques": true}, {"techniqueID": "T1683.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has created career-themed phishing lures to entice victims.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: Mandiant_UNC1549_Feb2024)     ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1683.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has generated fictitious job-related themed websites that entice users to interact and launch malicious actions.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)     \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also utilized decoy documents and files to provide a sense of legitimacy to the user.(Citation: Mandiant_UNC1549_Feb2024)     \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged fake Microsoft Outlook login windows prompts to entice victims to enter their credentials.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1574", "showSubtechniques": true}, {"techniqueID": "T1574.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged DLL search order hijacking and DLL sideloading to execute malicious payloads.(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1574.014", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged AppDomain Hijacking facilitated through a trojanized `.config` file.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has deleted files after successful actions.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070.007", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has cleared RDP connection history registry keys to include `HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal  Server Client\\Default` and ` HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has transferred and deployed malware to compromised hosts using remove management services, such as Atelier Web Remote Commander (AWRC), and SSH reverse tunnels.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1534", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has conducted internal spearphishing attacks against IT staff and administrators.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "showSubtechniques": true}, {"techniqueID": "T1036.004", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has masqueraded as legitimate services.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036.005", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has masqueraded as legitimate software.(Citation: CheckPoint_NimbusManticore_May2026) \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also mimicked legitimate installers to include Zoom.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1106", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized Native Windows API calls to execute on victim devices to include `GetModuleHandle`.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1046", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized PowerShell scripts to conduct ping and port scanning of victim subnets.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized a mix of obfuscation techniques to hamper analysis of custom malware.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1027.015", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged compressed archives to deliver malicious payloads to include zip files.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)         ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588", "showSubtechniques": true}, {"techniqueID": "T1588.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged legitimate tools and publicly available utilities to include AD Explorer.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has obtained and utilized valid digital signatures via SSL[.]com.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588.007", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has appeared to have leveraged AI to assist in malware generation due to coding patterns and modular code organization.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003", "showSubtechniques": true}, {"techniqueID": "T1003.006", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized DCSync to obtain NTLM password hashes for domain users.(Citation: Mandiant_UNC1549TTPsTools_Nov2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1566", "showSubtechniques": true}, {"techniqueID": "T1566.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has used spearphishing emails with malicious attachments to entice victims.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1566.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized malicious links in phishing emails that direct users to download a malicious payload.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)            ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1598", "showSubtechniques": true}, {"techniqueID": "T1598.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has corresponded and disseminated links to victims through social media.(Citation: Mandiant_UNC1549_Feb2024)          ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1057", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has enumerated active processes using remote management services to include Atelier Web Remote Commander (AWRC).(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1563", "showSubtechniques": true}, {"techniqueID": "T1563.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has conducted RDP session hijacking to gain access to victim devices.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1021", "showSubtechniques": true}, {"techniqueID": "T1021.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized RDP to log into victim devices using compromised user credentials.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1021.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has accessed SMB shares within the victim network to gather and exfiltrate data.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1053", "showSubtechniques": true}, {"techniqueID": "T1053.005", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has created scheduled tasks to maintain persistence.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1684", "showSubtechniques": true}, {"techniqueID": "T1684.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has impersonated legitimate companies with fake career opportunities.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1072", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized commercial remote access tools such as Atelier Web Remote Commander (AWRC) and Microsoft System Center Configuration Manager (SCCM) within victim environments.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)      ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1608", "showSubtechniques": true}, {"techniqueID": "T1608.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has staged malicious payloads on actor-controlled infrastructure for download to the victim environment.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1608.005", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) had registered domains that would point to a typo-squatted domain used to deliver malicious payloads.(Citation: CheckPoint_NimbusManticore_May2026) \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also pre-shared credentials with a link to spoofed phishing login pages that enable the download of malicious payloads when authorized credentials are used.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1608.006", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized Search Engine Optimization (SEO) poisoning to deliver malware to unsuspecting victims.(Citation: CheckPoint_NimbusManticore_May2026)  \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also registered dozens of domains that link to a typosquatted domain to generate link-based reputation signals and incorporated keyword stuffing to improve search ranking.(Citation: CheckPoint_NimbusManticore_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1649", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has stolen and leveraged vulnerable Active Directory Certificate Services templates to impersonate higher-privileged user accounts.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1558", "showSubtechniques": true}, {"techniqueID": "T1558.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also performed Kerberoasting for credential access using an obfuscated `Invoke-Kerberroast`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1049", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has enumerated existing RDP sessions using remote management services to include Atelier Web Remote Commander (AWRC).(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1007", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has identified running services using remote management services to include Atelier Web Remote Commander (AWRC).(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1199", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gained access to victim environments using trusted connections granted to third party partners, collaborators and contractors.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also leveraged trusted third-party services to include Citrix, VMware, Azure Virtual Desktop and Application Services to gain access to victim networks.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1552", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has obtained credentials from internal service ticketing systems.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1204", "showSubtechniques": true}, {"techniqueID": "T1204.001", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has enticed victims to click on links delivered in phishing campaigns.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1204.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has distributed malicious payloads by enticing users to open or run the executables contained within zip files.(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)       ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1078", "showSubtechniques": true}, {"techniqueID": "T1078.002", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged domain accounts for lateral movement and privilege escalation.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1078.003", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged valid accounts belonging to victim organizations to include those belonging to their trusted partners for initial access and lateral movement.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)  ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1078.004", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gained access to Azure AD Connect accounts to modify permissions and to create accounts for persistence.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1047", "comment": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged `wmic.exe` to enumerate logged in users on compromised devices.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)  ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by NIMBUS MANTICORE", "color": "#66b1ff"}]}