UNC1549

Introduction

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe. Mandiant_UNC1549TTPsTools_Nov2025 CheckPoint_NimbusManticore_May2026 CheckPoint_NimbusManticoreEurope_Sept2025 Mandiant_UNC1549_Feb2024

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1036.004 Masquerade Task or Service
• T1563.002 RDP Hijacking
• T1106 Native API
• T1685.003 Modify or Spoof Tool UI
• T1199 Trusted Relationship
• T1598.001 Spearphishing Service
• T1070.007 Clear Network Connection History and Configurations
• T1021.002 SMB/Windows Admin Shares
• T1049 System Network Connections Discovery
• T1098 Account Manipulation
• T1649 Steal or Forge Authentication Certificates
• T1057 Process Discovery
• T1608.001 Upload Malware
• T1678 Delay Execution
• T1087.001 Local Account
• T1683.002 Audio-Visual Content
• T1585.001 Social Media Accounts
• T1078.004 Cloud Accounts
• T1078.002 Domain Accounts
• T1608.005 Link Target
• T1213 Data from Information Repositories
• T1588.002 Tool
• T1583.001 Domains
• T1534 Internal Spearphishing
• T1684.001 Impersonation
• T1070.004 File Deletion
• T1003.006 DCSync
• T1039 Data from Network Shared Drive
• T1053.005 Scheduled Task
• T1608.006 SEO Poisoning
• T1071 Application Layer Protocol
• T1021.001 Remote Desktop Protocol
• T1566.001 Spearphishing Attachment
• T1574.014 AppDomainManager
• T1588.007 Artificial Intelligence
• T1587.001 Malware
• T1588.003 Code Signing Certificates
• T1136.001 Local Account
• T1566.002 Spearphishing Link
• T1204.001 Malicious Link
• T1072 Software Deployment Tools
• T1059.007 JavaScript
• T1547.001 Registry Run Keys / Startup Folder
• T1204.002 Malicious File
• T1574.001 DLL
• T1087.002 Domain Account
• T1591 Gather Victim Org Information
• T1047 Windows Management Instrumentation
• T1558.003 Kerberoasting
• T1552 Unsecured Credentials
• T1583.003 Virtual Private Server
• T1683.001 Written Content
• T1105 Ingress Tool Transfer
• T1213.005 Messaging Applications
• T1583.006 Web Services
• T1114.001 Local Email Collection
• T1007 System Service Discovery
• T1078.003 Local Accounts
• T1213.002 Sharepoint
• T1046 Network Service Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1027.015 Compression
• T1059.001 PowerShell
• T1027 Obfuscated Files or Information
• T1110.003 Password Spraying

ATT&CK technique IDs (denormalized)

• T1003.006
• T1007
• T1021.001
• T1021.002
• T1027
• T1027.015
• T1036.004
• T1036.005
• T1039
• T1046
• T1047
• T1049
• T1053.005
• T1057
• T1059.001
• T1059.007
• T1070.004
• T1070.007
• T1071
• T1072
• T1078.002
• T1078.003
• T1078.004
• T1087.001
• T1087.002
• T1098
• T1105
• T1106
• T1110.003
• T1114.001
• T1136.001
• T1199
• T1204.001
• T1204.002
• T1213
• T1213.002
• T1213.005
• T1534
• T1547.001
• T1552
• T1558.003
• T1563.002
• T1566.001
• T1566.002
• T1574.001
• T1574.014
• T1583.001
• T1583.003
• T1583.006
• T1585.001
• T1587.001
• T1588.002
• T1588.003
• T1588.007
• T1591
• T1598.001
• T1608.001
• T1608.005
• T1608.006
• T1649
• T1678
• T1683.001
• T1683.002
• T1684.001
• T1685.003

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• Backdoor.Oldrea

MITRE ATT&CK Software

• CRASHPAD (S9057) — malware
• MiniBus (S9060) — malware
• DCSYNCER.SLICK (S9065) — malware
• TRUSTTRAP (S9064) — malware
• TWOSTROKE (S9067) — malware
• MiniFast (S9052) — malware
• MiniJunk (S9053) — malware
• LIGHTRAIL (S9061) — malware
• MiniBrowse (S9062) — malware
• MiniBike (S9059) — malware
• DEEPROOT (S9063) — malware
• SIGHTGRAB (S9058) — malware
• POLLBLEND (S9066) — malware

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [5] CheckPoint_NimbusManticoreEurope_Sept2025 Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026. [6] CheckPoint_NimbusManticore_May2026 Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026. [7] Mandiant_UNC1549TTPsTools_Nov2025 El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026. [8] Mandiant_UNC1549_Feb2024 Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026. [9] Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025 Saher Naumaan and The Proofpoint Threat Research Team. (2025, November 5). Crossed wires: a case study of Iranian espionage and attribution. Retrieved October 5, 2026. [10] Sophos Iran Cobalt Smokey Nimbus Manticore October 2026 Sophos. (2026, October 5). Iran COBALT SMOKEY. Retrieved October 5, 2026.

Recent News

Latest articles from security news feeds mentioning this actor.

• Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler The Hacker News — 2026-08-26