APT / StateG1059

NIMBUS MANTICORE

Also known as: COBALT SMOKEY, TA455, UNC1549

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 65

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Org Information Spearphishing Service

Resource development

Domains Virtual Private Server Web Services Social Media Accounts Malware Tool Code Signing Certificates Artificial Intelligence Upload Malware Link Target SEO Poisoning Written Content Audio-Visual Content

Initial access

Trusted Relationship Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell JavaScript Software Deployment Tools Native API Malicious Link Malicious File

Persistence

Account Manipulation Local Account Registry Run Keys / Startup Folder

Credential access

DCSync Password Spraying Unsecured Credentials Kerberoasting Steal or Forge Authentication Certificates

Discovery

System Service Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Account Domain Account

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares Internal Spearphishing RDP Hijacking

Collection

Data from Network Shared Drive Local Email Collection Data from Information Repositories Sharepoint Messaging Applications

Command and control

Application Layer Protocol Ingress Tool Transfer

defense-impairment

Modify or Spoof Tool UI

stealth

Obfuscated Files or Information Compression Masquerade Task or Service Match Legitimate Resource Name or Location File Deletion Clear Network Connection History and Configurations Domain Accounts Local Accounts Cloud Accounts DLL AppDomainManager Delay Execution Impersonation

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 12

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

md5_hashDE5AF16A3757EF700B01DC34D67079AEMiniFastthreatfox

md5_hashE259C5EDF158AAC4CFE14F77DDD0B196MiniFastthreatfox

md5_hashE95A4366686E3F786EA3C056FAB5B0DAMiniFastthreatfox

md5_hash366515822D5AC1CC500711EF57A2E32EMiniFastthreatfox

md5_hash795E053A990A1569FFDCB57F48F6D085MiniFastthreatfox

md5_hashCBAAF0900A13F28E380F49ADECEC932CMiniFastthreatfox

md5_hash0962F56D7EC69F4F2A0162DCBE22116BMiniFastthreatfox

md5_hashBE086789568441D0D7E4679AEE51F566MiniFastthreatfox

md5_hashCF449F1992C2819E62AC44A0B06AC2E7MiniFastthreatfox

md5_hash810F8E3B88EB05F710C09552941D6F56MiniFastthreatfox

md5_hash1EA83E4E4592B01E4ACAB63EB867BEE5MiniFastthreatfox

md5_hash291AC3ABE73C5158E59A437B75D5F0AAMiniFastthreatfox

References

NIMBUS MANTICORE uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →