NIMBUS MANTICORE
MITRE ATT&CK: G1059 View on attack.mitre.org
Aliases: Nimbus Manticore, NIMBUS MANTICORE, UNC1549, TA455, COBALT SMOKEY
- First seen
- 2022-06-01 00:00:00
- Origin
- IR
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-10-15 03:00:04
Targeted industries: defense-and-aerospace government-and-public-sector healthcare-and-pharmaceutical financial-services
Targeted regions: country_code:sa country_code:ae country_code:iq
Context
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)
Reports & references
- MITRE ATT&CK — G1059 (report)
- cloud.google.com — Analysis Of Unc1549 Ttps Targeting Aerospace Defense (report)
- cloud.google.com — Suspected Iranian Unc1549 Targets Israel Middle East (report)
- research.checkpoint.com — Fast And Furious Nimbus Manticore Operations During The Iranian Conflict (report)
- proofpoint.com — Crossed Wires Case Study Iranian Espionage And Attribution (report)
- sophos.com — Cobalt Smokey (report)
- Mandiant — Suspected Iranian Unc1549 Targets Israel Middle East (report)
- research.checkpoint.com — Nimbus Manticore Deploys New Malware Targeting Europe (report)
- blog.checkpoint.com — Iranian Threat Actor Nimbus Manticore Expands Campaigns Into Europe With Advanced Malware And Fake Job Lures (report)