NIMBUS MANTICORE
- ID
- G1059
- Associated names
- UNC1549, TA455, COBALT SMOKEY
- Source
- attack.mitre.org
- MITRE last modified
- 5 Oct 2026
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.[1][2][3][4]
Techniques used (65)
- T1003.006 DCSync
- T1007 System Service Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1027.015 Compression
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1070.004 File Deletion
- T1070.007 Clear Network Connection History and Configurations
- T1071 Application Layer Protocol
- T1072 Software Deployment Tools
- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1078.004 Cloud Accounts
- T1087.001 Local Account
- T1087.002 Domain Account
- T1098 Account Manipulation
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1110.003 Password Spraying
- T1114.001 Local Email Collection
- T1136.001 Local Account
- T1199 Trusted Relationship
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1213 Data from Information Repositories
- T1213.002 Sharepoint
- T1213.005 Messaging Applications
- T1534 Internal Spearphishing
- T1547.001 Registry Run Keys / Startup Folder
- T1552 Unsecured Credentials
- T1558.003 Kerberoasting
- T1563.002 RDP Hijacking
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1574.001 DLL
- T1574.014 AppDomainManager
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1588.007 Artificial Intelligence
- T1591 Gather Victim Org Information
- T1598.001 Spearphishing Service
- T1608.001 Upload Malware
- T1608.005 Link Target
- T1608.006 SEO Poisoning
- T1649 Steal or Forge Authentication Certificates
- T1678 Delay Execution
- T1683.001 Written Content
- T1683.002 Audio-Visual Content
- T1684.001 Impersonation
- T1685.003 Modify or Spoof Tool UI
Software used (13)
- S9052 MiniFast
- S9053 MiniJunk
- S9057 CRASHPAD
- S9058 SIGHTGRAB
- S9059 MiniBike
- S9060 MiniBus
- S9061 LIGHTRAIL
- S9062 MiniBrowse
- S9063 DEEPROOT
- S9064 TRUSTTRAP
- S9065 DCSYNCER.SLICK
- S9066 POLLBLEND
- S9067 TWOSTROKE