Educated Manticore
- Origin
- IR
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:22:50
Targeted industries: government-and-public-sector defense-and-aerospace education-and-nonprofits
Targeted regions: country_code:il
Context
Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targeting government, military, and academic sectors. The group employs spear-phishing tactics, utilizing custom backdoors like POWERLESS and phishing kits designed as SPAs to harvest credentials. Their operations have included impersonating credible figures to lure victims and using ISO images to initiate infection chains. Educated Manticore's activities are characterized by rapid domain setup and aggressive spear-phishing campaigns, particularly against Israeli individuals.
Reports & references
- research.checkpoint.com — Iranian Educated Manticore Targets Leading Tech Academics (report)
- blog.checkpoint.com — Check Point Research Uncovers Rare Techniques Used By Iranian Affiliated Threat Actor Targeting Israeli Entities (report)
- research.checkpoint.com — Educated Manticore Iran Aligned Threat Actor Targeting Israel Via Improved Arsenal Of Tools (report)