Início / Grupos de ameaça / NIMBUS MANTICORE

NIMBUS MANTICORE G1059

🔔 Criar alerta

Também conhecido como: UNC1549, TA455, COBALT SMOKEY

Atualizado na fonte em 05/10/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

81

Técnicas

13

Malwares e ferramentas

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1591 Gather Victim Org Information T1598.001 Spearphishing Service

Desenvolvimento de recursos

T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1585.001 Social Media Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.007 Artificial Intelligence T1608.001 Upload Malware T1608.005 Link Target T1608.006 SEO Poisoning T1683.001 Written Content T1683.002 Audio-Visual Content

Acesso inicial

T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1199 Trusted Relationship T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.007 JavaScript T1072 Software Deployment Tools T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL T1574.014 AppDomainManager

Persistência

T1053.005 Scheduled Task T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1136.001 Local Account T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1027.015 Compression T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.007 Clear Network Connection History and Configurations T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1574.001 DLL T1574.014 AppDomainManager T1678 Delay Execution T1684.001 Impersonation

Comprometimento de defesas

T1685.003 Modify or Spoof Tool UI

Acesso a credenciais

T1003.006 DCSync T1110.003 Password Spraying T1552 Unsecured Credentials T1558.003 Kerberoasting T1649 Steal or Forge Authentication Certificates

Descoberta

T1007 System Service Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1087.001 Local Account T1087.002 Domain Account

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1072 Software Deployment Tools T1534 Internal Spearphishing T1563.002 RDP Hijacking

Coleta

T1039 Data from Network Shared Drive T1114.001 Local Email Collection T1213 Data from Information Repositories T1213.002 Sharepoint T1213.005 Messaging Applications

Comando e controle

T1071 Application Layer Protocol T1105 Ingress Tool Transfer

Malwares e ferramentas

CRASHPADMalwareS9057
DCSYNCER.SLICKMalwareS9065
DEEPROOTMalwareS9063
LIGHTRAILMalwareS9061
MiniBikeMalwareS9059
MiniBrowseMalwareS9062
MiniBusMalwareS9060
MiniFastMalwareS9052
MiniJunkMalwareS9053
POLLBLENDMalwareS9066
SIGHTGRABMalwareS9058
TRUSTTRAPMalwareS9064
TWOSTROKEMalwareS9067

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.