APT / EstatalG1059

NIMBUS MANTICORE

Também conhecido como: COBALT SMOKEY, TA455, UNC1549

Aviso por e-mail de CVE nova atribuída, vítima nova no Brasil e incidente verificado.

Sobre o grupo

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

Cadeia de ataque

Cenário plausível montado a partir das técnicas reais do grupo, ordenadas pelas fases de um ataque. Cada etapa mostra como o grupo costuma agir.

Severidade do arsenal59

Impacto: Alto

Cadeia ilustrativa derivada das técnicas documentadas no MITRE ATT&CK — não representa um ataque específico já ocorrido. A severidade resume o arsenal conhecido (cobertura da cadeia, CVEs em exploração ativa, técnicas).

Técnicas (MITRE ATT&CK) 65

Como o grupo opera, mapeado pela matriz MITRE ATT&CK e organizado pelas fases de um ataque.

Reconhecimento

Gather Victim Org Information Spearphishing Service

Preparação de recursos

Domains Virtual Private Server Web Services Social Media Accounts Malware Tool Code Signing Certificates Artificial Intelligence Upload Malware Link Target SEO Poisoning Written Content Audio-Visual Content

Acesso inicial

Trusted Relationship Spearphishing Attachment Spearphishing Link

Execução

Windows Management Instrumentation Scheduled Task PowerShell JavaScript Software Deployment Tools Native API Malicious Link Malicious File

Persistência

Account Manipulation Local Account Registry Run Keys / Startup Folder

Acesso a credenciais

DCSync Password Spraying Unsecured Credentials Kerberoasting Steal or Forge Authentication Certificates

Descoberta

System Service Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Account Domain Account

Movimento lateral

Remote Desktop Protocol SMB/Windows Admin Shares Internal Spearphishing RDP Hijacking

Coleta

Data from Network Shared Drive Local Email Collection Data from Information Repositories Sharepoint Messaging Applications

Comando e controle

Application Layer Protocol Ingress Tool Transfer

defense-impairment

Modify or Spoof Tool UI

stealth

Obfuscated Files or Information Compression Masquerade Task or Service Match Legitimate Resource Name or Location File Deletion Clear Network Connection History and Configurations Domain Accounts Local Accounts Cloud Accounts DLL AppDomainManager Delay Execution Impersonation

Vulnerabilidades exploradas

Nenhuma CVE atribuída a este grupo nas fontes públicas (MITRE ATT&CK). Ausência de atribuição não significa ausência de atividade.

Infraestrutura conhecida 12

Indicadores reais (C2, domínios, URLs e hashes) associados ao malware que este grupo utiliza. Fonte: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

md5_hashDE5AF16A3757EF700B01DC34D67079AEMiniFastthreatfox

md5_hashE259C5EDF158AAC4CFE14F77DDD0B196MiniFastthreatfox

md5_hashE95A4366686E3F786EA3C056FAB5B0DAMiniFastthreatfox

md5_hash366515822D5AC1CC500711EF57A2E32EMiniFastthreatfox

md5_hash795E053A990A1569FFDCB57F48F6D085MiniFastthreatfox

md5_hashCBAAF0900A13F28E380F49ADECEC932CMiniFastthreatfox

md5_hash0962F56D7EC69F4F2A0162DCBE22116BMiniFastthreatfox

md5_hashBE086789568441D0D7E4679AEE51F566MiniFastthreatfox

md5_hashCF449F1992C2819E62AC44A0B06AC2E7MiniFastthreatfox

md5_hash810F8E3B88EB05F710C09552941D6F56MiniFastthreatfox

md5_hash1EA83E4E4592B01E4ACAB63EB867BEE5MiniFastthreatfox

md5_hash291AC3ABE73C5158E59A437B75D5F0AAMiniFastthreatfox

Referências

O grupo NIMBUS MANTICORE usa técnicas e explora falhas reais. O Pentest Autônomo com IA da TrueHacking simula esses ataques na sua infraestrutura e traz mais segurança para sua aplicação.

Conhecer o Pentest Autônomo com IA →