Threat actor
Nimbus Manticore
Iran
Tracked by CyberSIXT since 19 Sep 2025
- Articles · all time
- 18
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 4
18 articles from 1 outlet; the latest 49 days ago.
- Article
- Research report
Show as table
Names and sources
- UNC1549
- Named by CyberSIXT coverage
- Nimbus Manticore
- Named by Malpedia · unc1549
- UNC1549
- Named by Malpedia · unc1549
- Nimbus Manticore
- Named by MISP Galaxy · a2a7d49f-f517-4eeb-9ec8-b9b74e3fe756
- UNC1549
- Named by MISP Galaxy · a2a7d49f-f517-4eeb-9ec8-b9b74e3fe756
- COBALT SMOKEY
- Named by MITRE ATT&CK® · G1059
- NIMBUS MANTICORE
- Named by MITRE ATT&CK® · G1059
- TA455
- Named by MITRE ATT&CK® · G1059
All 10 names
- UNC1549
- Named by MITRE ATT&CK® · G1059
- a2a7d49f-f517-4eeb-9ec8-b9b74e3fe756
- Named by CyberSIXT coverage
Attributed facts
- origin
- Iran (MISP Galaxy · a2a7d49f-f517-4eeb-9ec8-b9b74e3fe756)
Malware and tools
MiniFast (MITRE ATT&CK® · G1059) MiniJunk (MITRE ATT&CK® · G1059) CRASHPAD (MITRE ATT&CK® · G1059) SIGHTGRAB (MITRE ATT&CK® · G1059) MiniBike (MITRE ATT&CK® · G1059) MiniBus (MITRE ATT&CK® · G1059) LIGHTRAIL (MITRE ATT&CK® · G1059) MiniBrowse (MITRE ATT&CK® · G1059) DEEPROOT (MITRE ATT&CK® · G1059) TRUSTTRAP (MITRE ATT&CK® · G1059) DCSYNCER.SLICK (MITRE ATT&CK® · G1059) POLLBLEND (MITRE ATT&CK® · G1059) TWOSTROKE (MITRE ATT&CK® · G1059) MiniFast (Malpedia · unc1549)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1059
Execution
- T1047
- Windows Management Instrumentation
Stealth
Credential Access
- T1003.006
- DCSync
Discovery
Collection
- T1039
- Data from Network Shared Drive
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Also mentioned alongside Nimbus Manticore (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Nimbus Manticore.
- Mirage Kitten Targets Developers With Dual Backdoors in Coding TestsSecurityOnline
- Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding TestsThe Hacker News
- Nimbus Manticore adds TWOSTROKE backdoor and SSH tunnellerThe Hacker News
- Iran linked Mirage Kitten rolls out NightLedger backdoor in MEASecurityOnline
- NightLedger Malware Hijacks Victim PCs as Covert Espionage RelaysThe Hacker News
- Mirage Kitten APT Deploys NightLedger on Aerospace & TelecomSecurelist
- Iranian APT Nimbus Manticore Shifts Focus to US Aviation SoftwareSecurityWeek
- Nimbus Manticore hackers hit US aviation via fake Oracle SQL pageInfosecurity
- Iranian hackers use AI malware, SEO tricks in US aviation attacksSecurity Affairs
- Hackers Use MiniFast, MiniJunk V2 in Phishing, SEO PoisoningThe Hacker News
- Iranian hackers revive with SEO poison, fake Zoom and AI backdoorCheck Point
- US defence contractors warned of nation state edge device attacksInfosecurity
The latest 12 are listed. See all 18 articles in the timeline.
Research reports
- Mirage Kitten targets Middle East and Africa region with new malwareOrkl.eu · 8 Sep
- Fast and Furious – Nimbus Manticore Operations During the Iranian ConflictOrkl.eu · 3 Jun
- Detecting Nimbus Manticore and their sideloading infection chainsOrkl.eu · 3 Jun
- Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job LuresOrkl.eu · 13 Apr