nextron-systems.comPublished
Detecting Nimbus Manticore and their sideloading infection chains
By Jonathan Peters
Excerpt
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore, also tracked as UNC1549 and Smoke Sandstorm. The group primarily targets aerospace and defense organizations in the Middle East and Europe.
Nimbus Manticore is known for targeted phishing operations and the use of custom implants. While individual payloads and tooling vary in between campaigns, the group’s core tradecraft remains relatively consistent. In this article, we compare implants previously reported by…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by nextron-systems.com on nextron-systems.com.
Mentioned in the excerpt
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
