CVE Intelligence
Home / Threat actors / NIMBUS MANTICORE

NIMBUS MANTICORE G1059

🔔 Create alert

Also known as: UNC1549, TA455, COBALT SMOKEY

Updated at source on Oct 5, 2026 · View on MITRE ATT&CK

0
associated CVEs
81
Techniques
13
Malware and tools

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1591 Gather Victim Org InformationT1598.001 Spearphishing Service
Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1585.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.003 Code Signing CertificatesT1588.007 Artificial IntelligenceT1608.001 Upload MalwareT1608.005 Link TargetT1608.006 SEO PoisoningT1683.001 Written ContentT1683.002 Audio-Visual Content
Initial Access
T1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.007 JavaScriptT1072 Software Deployment ToolsT1106 Native APIT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLLT1574.014 AppDomainManager
Persistence
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1136.001 Local AccountT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027 Obfuscated Files or InformationT1027.015 CompressionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.007 Clear Network Connection History and ConfigurationsT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1574.001 DLLT1574.014 AppDomainManagerT1678 Delay ExecutionT1684.001 Impersonation
Defense Impairment
T1685.003 Modify or Spoof Tool UI
Credential Access
T1003.006 DCSyncT1110.003 Password SprayingT1552 Unsecured CredentialsT1558.003 KerberoastingT1649 Steal or Forge Authentication Certificates
Discovery
T1007 System Service DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1087.001 Local AccountT1087.002 Domain Account
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1534 Internal SpearphishingT1563.002 RDP Hijacking
Collection
T1039 Data from Network Shared DriveT1114.001 Local Email CollectionT1213 Data from Information RepositoriesT1213.002 SharepointT1213.005 Messaging Applications
Command and Control
T1071 Application Layer ProtocolT1105 Ingress Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.