APT / EstatalG1059

NIMBUS MANTICORE

También conocido como: COBALT SMOKEY, TA455, UNC1549

Aviso por correo de CVE nueva atribuida, víctima nueva en Brasil e incidente verificado.

Sobre el grupo

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal59

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 65

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Reconocimiento

Gather Victim Org Information Spearphishing Service

Preparación de recursos

Domains Virtual Private Server Web Services Social Media Accounts Malware Tool Code Signing Certificates Artificial Intelligence Upload Malware Link Target SEO Poisoning Written Content Audio-Visual Content

Acceso inicial

Trusted Relationship Spearphishing Attachment Spearphishing Link

Ejecución

Windows Management Instrumentation Scheduled Task PowerShell JavaScript Software Deployment Tools Native API Malicious Link Malicious File

Persistencia

Account Manipulation Local Account Registry Run Keys / Startup Folder

Acceso a credenciales

DCSync Password Spraying Unsecured Credentials Kerberoasting Steal or Forge Authentication Certificates

Descubrimiento

System Service Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Account Domain Account

Movimiento lateral

Remote Desktop Protocol SMB/Windows Admin Shares Internal Spearphishing RDP Hijacking

Recolección

Data from Network Shared Drive Local Email Collection Data from Information Repositories Sharepoint Messaging Applications

Comando y control

Application Layer Protocol Ingress Tool Transfer

defense-impairment

Modify or Spoof Tool UI

stealth

Obfuscated Files or Information Compression Masquerade Task or Service Match Legitimate Resource Name or Location File Deletion Clear Network Connection History and Configurations Domain Accounts Local Accounts Cloud Accounts DLL AppDomainManager Delay Execution Impersonation

Vulnerabilidades explotadas

Ninguna CVE atribuida a este grupo en las fuentes públicas (MITRE ATT&CK). La ausencia de atribución no significa ausencia de actividad.

Infraestructura conocida 12

Indicadores reales (C2, dominios, URLs y hashes) asociados al malware que usa este grupo. Fuente: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

md5_hashDE5AF16A3757EF700B01DC34D67079AEMiniFastthreatfox

md5_hashE259C5EDF158AAC4CFE14F77DDD0B196MiniFastthreatfox

md5_hashE95A4366686E3F786EA3C056FAB5B0DAMiniFastthreatfox

md5_hash366515822D5AC1CC500711EF57A2E32EMiniFastthreatfox

md5_hash795E053A990A1569FFDCB57F48F6D085MiniFastthreatfox

md5_hashCBAAF0900A13F28E380F49ADECEC932CMiniFastthreatfox

md5_hash0962F56D7EC69F4F2A0162DCBE22116BMiniFastthreatfox

md5_hashBE086789568441D0D7E4679AEE51F566MiniFastthreatfox

md5_hashCF449F1992C2819E62AC44A0B06AC2E7MiniFastthreatfox

md5_hash810F8E3B88EB05F710C09552941D6F56MiniFastthreatfox

md5_hash1EA83E4E4592B01E4ACAB63EB867BEE5MiniFastthreatfox

md5_hash291AC3ABE73C5158E59A437B75D5F0AAMiniFastthreatfox

Referencias

El grupo NIMBUS MANTICORE usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →