G1059: NIMBUS MANTICORE
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.[1][2][3][4]
Security context for executives and security teams
G1059: NIMBUS MANTICORE describes [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has sought sensitive information in victims’ environments to include network/IT docume...
Executive priority
G1059: NIMBUS MANTICORE is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G1059: NIMBUS MANTICORE by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G1059: NIMBUS MANTICORE appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
NIMBUS MANTICORE
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | NIMBUS MANTICORE has masqueraded as legitimate services.[2] |
| Enterprise | T1563.002 | RDP HijackingSub-technique | NIMBUS MANTICORE has conducted RDP session hijacking to gain access to victim devices.[1] |
| Enterprise | T1106 | Native API | NIMBUS MANTICORE has utilized Native Windows API calls to execute on victim devices to include `GetModuleHandle`.[3] |
| Enterprise | T1685.003 | Modify or Spoof Tool UISub-technique | NIMBUS MANTICORE has prompted victims with fake warnings and error messages to appear as legitimate failures to reduce user suspicion.[2][3][4] |
| Enterprise | T1199 | Trusted Relationship | NIMBUS MANTICORE has gained access to victim environments using trusted connections granted to third party partners, collaborators and contractors.[1] NIMBUS MANTICORE has also leveraged trusted third-party services to include Citrix, VMware, Azure Virtual Desktop and Application Services to gain access to victim networks.[1] |
| Enterprise | T1598.001 | Spearphishing ServiceSub-technique | NIMBUS MANTICORE has corresponded and disseminated links to victims through social media.[4] |
| Enterprise | T1070.007 | Clear Network Connection History and ConfigurationsSub-technique | NIMBUS MANTICORE has cleared RDP connection history registry keys to include `HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default` and ` HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers`.[1] |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | NIMBUS MANTICORE has accessed SMB shares within the victim network to gather and exfiltrate data.[1] |
| Enterprise | T1049 | System Network Connections Discovery | NIMBUS MANTICORE has enumerated existing RDP sessions using remote management services to include Atelier Web Remote Commander (AWRC).[1] |
| Enterprise | T1098 | Account Manipulation | NIMBUS MANTICORE has reset passwords of valid accounts to include domain accounts in order to obtain persistence and escalate privileges.[1] NIMBUS MANTICORE has reset passwords for domain controller accounts using `net.exe` through the command `net user DC-01$ P@ssw0rd`.[1] NIMBUS MANTICORE has also abused Resource-Based Constrained Delegation (RBCD) assignments to impersonate high-privileged users and gain unauthorized access to services and resources.[1] |
| Enterprise | T1649 | Steal or Forge Authentication Certificates | NIMBUS MANTICORE has stolen and leveraged vulnerable Active Directory Certificate Services templates to impersonate higher-privileged user accounts.[1] |
| Enterprise | T1057 | Process Discovery | NIMBUS MANTICORE has enumerated active processes using remote management services to include Atelier Web Remote Commander (AWRC).[1] |
| Enterprise | T1608.001 | Upload MalwareSub-technique | NIMBUS MANTICORE has staged malicious payloads on actor-controlled infrastructure for download to the victim environment.[2][3][4][1] |
| Enterprise | T1678 | Delay Execution | NIMBUS MANTICORE has planted backdoors that beacon silently for long-term persistence, activating them again after the victim has attempted eradication.[1] |
| Enterprise | T1087.001 | Local AccountSub-technique | NIMBUS MANTICORE has identified logged in users on victim hosts using `quser.exe` and `wmic.exe`.[1] |
| Enterprise | T1683.002 | Audio-Visual ContentSub-technique | NIMBUS MANTICORE has generated fictitious job-related themed websites that entice users to interact and launch malicious actions.[3][4] NIMBUS MANTICORE has also utilized decoy documents and files to provide a sense of legitimacy to the user.[4] NIMBUS MANTICORE has leveraged fake Microsoft Outlook login windows prompts to entice victims to enter their credentials.[1] |
| Enterprise | T1585.001 | Social Media AccountsSub-technique | NIMBUS MANTICORE has leveraged social media accounts to correspond with victims.[4] |
| Enterprise | T1078.004 | Cloud AccountsSub-technique | NIMBUS MANTICORE has gained access to Azure AD Connect accounts to modify permissions and to create accounts for persistence.[1] |
| Enterprise | T1078.002 | Domain AccountsSub-technique | NIMBUS MANTICORE has leveraged domain accounts for lateral movement and privilege escalation.[1] |
| Enterprise | T1608.005 | Link TargetSub-technique | NIMBUS MANTICORE had registered domains that would point to a typo-squatted domain used to deliver malicious payloads.[2] NIMBUS MANTICORE has also pre-shared credentials with a link to spoofed phishing login pages that enable the download of malicious payloads when authorized credentials are used.[3][1] |
| Enterprise | T1213 | Data from Information Repositories | NIMBUS MANTICORE has gathered data from internal service ticketing systems to include credentials.[1] |
| Enterprise | T1588.002 | ToolSub-technique | NIMBUS MANTICORE has leveraged legitimate tools and publicly available utilities to include AD Explorer.[1] |
| Enterprise | T1583.001 | DomainsSub-technique | NIMBUS MANTICORE has created fake domains that imitate legitimate brands and services.[3][4][1] |
| Enterprise | T1534 | Internal Spearphishing | NIMBUS MANTICORE has conducted internal spearphishing attacks against IT staff and administrators.[1] |
| Enterprise | T1684.001 | ImpersonationSub-technique | NIMBUS MANTICORE has impersonated legitimate companies with fake career opportunities.[2][3][4][1] |
| Enterprise | T1070.004 | File DeletionSub-technique | NIMBUS MANTICORE has deleted files after successful actions.[1] |
| Enterprise | T1003.006 | DCSyncSub-technique | NIMBUS MANTICORE has utilized DCSync to obtain NTLM password hashes for domain users.[1] |
| Enterprise | T1039 | Data from Network Shared Drive | NIMBUS MANTICORE has collected data from SMB shares within the victim network.[1] |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | NIMBUS MANTICORE has created scheduled tasks to maintain persistence.[3] |
| Enterprise | T1608.006 | SEO PoisoningSub-technique | NIMBUS MANTICORE has utilized Search Engine Optimization (SEO) poisoning to deliver malware to unsuspecting victims.[2] NIMBUS MANTICORE has also registered dozens of domains that link to a typosquatted domain to generate link-based reputation signals and incorporated keyword stuffing to improve search ranking.[2] |
| Enterprise | T1071 | Application Layer Protocol | NIMBUS MANTICORE has leveraged reverse SSH shells for command and control.[1] |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | NIMBUS MANTICORE has utilized RDP to log into victim devices using compromised user credentials.[1] |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | NIMBUS MANTICORE has used spearphishing emails with malicious attachments to entice victims.[1] |
| Enterprise | T1574.014 | AppDomainManagerSub-technique | NIMBUS MANTICORE has leveraged AppDomain Hijacking facilitated through a trojanized `.config` file.[2] |
| Enterprise | T1588.007 | Artificial IntelligenceSub-technique | NIMBUS MANTICORE has appeared to have leveraged AI to assist in malware generation due to coding patterns and modular code organization.[2] |
| Enterprise | T1587.001 | MalwareSub-technique | NIMBUS MANTICORE has generated custom malware.[2][3][4][1] NIMBUS MANTICORE has incorporated AI-generated code in its malware development.[2] |
| Enterprise | T1588.003 | Code Signing CertificatesSub-technique | NIMBUS MANTICORE has obtained and utilized valid digital signatures via SSL[.]com.[2][3][1] |
| Enterprise | T1136.001 | Local AccountSub-technique | NIMBUS MANTICORE has created rogue accounts within the compromised environments.[1] |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | NIMBUS MANTICORE has utilized malicious links in phishing emails that direct users to download a malicious payload.[2][3][4][1] |
| Enterprise | T1204.001 | Malicious LinkSub-technique | NIMBUS MANTICORE has enticed victims to click on links delivered in phishing campaigns.[2][3][4][1] |
| Enterprise | T1072 | Software Deployment Tools | NIMBUS MANTICORE has utilized commercial remote access tools such as Atelier Web Remote Commander (AWRC) and Microsoft System Center Configuration Manager (SCCM) within victim environments.[1] |
| Enterprise | T1059.007 | JavaScriptSub-technique | NIMBUS MANTICORE has used React templates to generate impersonated branded websites that deliver malicious payloads to victims.[3] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | NIMBUS MANTICORE has utilized auto-run registry keys to execute benign Windows executables that trigger the execution of a malicious payload.[3][4] |
| Enterprise | T1204.002 | Malicious FileSub-technique | NIMBUS MANTICORE has distributed malicious payloads by enticing users to open or run the executables contained within zip files.[2][3][4][1] |
| Enterprise | T1574.001 | DLLSub-technique | NIMBUS MANTICORE has leveraged DLL search order hijacking and DLL sideloading to execute malicious payloads.[4][1][3] |
| Enterprise | T1087.002 | Domain AccountSub-technique | NIMBUS MANTICORE has enumerated user accounts and group memberships using `net user` and `net group`.[1] NIMBUS MANTICORE also leveraged the legitimate tool AD Explorer to query Active Directory.[1] |
| Enterprise | T1591 | Gather Victim Org Information | NIMBUS MANTICORE has gathered details on victims to ensure they target members of organizations within software or aviation.[2] |
| Enterprise | T1047 | Windows Management Instrumentation | NIMBUS MANTICORE has leveraged `wmic.exe` to enumerate logged in users on compromised devices.[1] |
| Enterprise | T1558.003 | KerberoastingSub-technique | NIMBUS MANTICORE has also performed Kerberoasting for credential access using an obfuscated `Invoke-Kerberroast`.[1] |
| Enterprise | T1552 | Unsecured Credentials | NIMBUS MANTICORE has obtained credentials from internal service ticketing systems.[1] |
| Enterprise | T1583.003 | Virtual Private ServerSub-technique | NIMBUS MANTICORE has utilized Azure C2 subdomains that resemble `*[.]*[.]cloudapp[.]azure[.]com`.[4][1] NIMBUS MANTICORE also utilized services that would reflect the geolocation of their targeted victims.[4] |
| Enterprise | T1683.001 | Written ContentSub-technique | NIMBUS MANTICORE has created career-themed phishing lures to entice victims.[2][4] |
| Enterprise | T1105 | Ingress Tool Transfer | NIMBUS MANTICORE has transferred and deployed malware to compromised hosts using remove management services, such as Atelier Web Remote Commander (AWRC), and SSH reverse tunnels.[1] |
| Enterprise | T1213.005 | Messaging ApplicationsSub-technique | NIMBUS MANTICORE has browsed Microsoft Teams and downloaded files.[1] |
| Enterprise | T1583.006 | Web ServicesSub-technique | NIMBUS MANTICORE has utilized the OnlyOffice platform to deliver malicious payloads to victims.[2] NIMBUS MANTICORE has utilized webservices in attempts to provide a sense of legitimacy to its infrastructure to include *[.]azurewebsites[.]net.[2][3][4][1] NIMBUS MANTICORE has also utilized Cloudflare.[3] |
| Enterprise | T1114.001 | Local Email CollectionSub-technique | NIMBUS MANTICORE has reviewed older emails within compromised inboxes to aid in crafting custom email lures.[1] |
| Enterprise | T1007 | System Service Discovery | NIMBUS MANTICORE has identified running services using remote management services to include Atelier Web Remote Commander (AWRC).[1] |
| Enterprise | T1078.003 | Local AccountsSub-technique | NIMBUS MANTICORE has leveraged valid accounts belonging to victim organizations to include those belonging to their trusted partners for initial access and lateral movement.[1] |
| Enterprise | T1213.002 | SharepointSub-technique | NIMBUS MANTICORE has downloaded files from SharePoint services.[1] |
| Enterprise | T1046 | Network Service Discovery | NIMBUS MANTICORE has utilized PowerShell scripts to conduct ping and port scanning of victim subnets.[1] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | NIMBUS MANTICORE has masqueraded as legitimate software.[2] NIMBUS MANTICORE has also mimicked legitimate installers to include Zoom.[2] |
| Enterprise | T1027.015 | CompressionSub-technique | NIMBUS MANTICORE has leveraged compressed archives to deliver malicious payloads to include zip files.[2][3][4] |
| Enterprise | T1059.001 | PowerShellSub-technique | NIMBUS MANTICORE has leveraged PowerShell scripts to execute commands in the victim environment.[1] |
| Enterprise | T1027 | Obfuscated Files or Information | NIMBUS MANTICORE has utilized a mix of obfuscation techniques to hamper analysis of custom malware.[3] |
| Enterprise | T1110.003 | Password SprayingSub-technique | NIMBUS MANTICORE has conducted password spraying attacks against victim environments.[1] |
Groups, software, and campaigns
S9057: CRASHPAD
CRASHPAD is a Windows executable written in C++ that gathers data from web browsers.[1] CRASHPAD was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9060: MiniBus
MiniBus is a custom backdoor used for command execution, data discovery, gathering, and exfiltration. MiniBus has utilized Azure Cloud Infrastructure and unique adversary-controlled domains for command and control. MiniBus is an updated platform to its predecessor MiniBike and was first observed in August 2023. MiniBus has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9065: DCSYNCER.SLICK
DCSYNCER.SLICK is a Windows executable that is designed to gather credentials from victim devices.[1] DCSYNCER.SLICK was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9064: TRUSTTRAP
TRUSTTRAP is a malware that uses a fictitious prompt to trick users to submit their credentials.[1] TRUSTTRAP was first observed in 2023 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9067: TWOSTROKE
TWOSTROKE is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and exfiltrating data.[1] TWOSTROKE was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9052: MiniFast
MiniFast is a custom malware designed for long-term persistence and remote code execution. MiniFast is a modular malware suspected of being generated using artificial intelligence (AI). MiniFast was first observed in early-2026 and is a modified version of the MiniJunk framework. MiniFast has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9053: MiniJunk
MiniJunk is a custom malware designed for long-term persistence and remote code execution.[1] MiniJunk was first observed in 2025 and is a modified version of the MiniBike framework that was first observed in June 2022.[1] MiniJunk has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9061: LIGHTRAIL
S9062: MiniBrowse
MiniBrowse is a custom stealer designed for the theft of credentials in browsers and passwords stores. MiniBrowse was first observed in late-2025.[1] MiniBrowse has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9059: MiniBike
MiniBike is a custom backdoor written in C++ designed for command execution, data discovery, gathering, and exfiltration.[1] MiniBike has been known to communicate with the C2 using Azure Cloud Infrastructure. MiniBike was first observed in 2022.[1] MiniBike has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
S9063: DEEPROOT
S9058: SIGHTGRAB
SIGHTGRAB is a Windows executable written in C that captures and stages stolen data on victim devices.[1] SIGHTGRAB was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 41d0d7e25e4d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Mandiant_UNC1549TTPsTools_Nov2025
El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.
Open source URL - [2]CheckPoint_NimbusManticore_May2026
Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.
Open source URL - [3]CheckPoint_NimbusManticoreEurope_Sept2025
Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.
Open source URL - [4]Mandiant_UNC1549_Feb2024
Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.
Open source URL - [5]COBALT SMOKEY
(Citation: Sophos Iran Cobalt Smokey Nimbus Manticore October 2026)
- [6]Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025
Saher Naumaan and The Proofpoint Threat Research Team. (2025, November 5). Crossed wires: a case study of Iranian espionage and attribution. Retrieved October 5, 2026.
Open source URL - [7]Sophos Iran Cobalt Smokey Nimbus Manticore October 2026
Sophos. (2026, October 5). Iran COBALT SMOKEY. Retrieved October 5, 2026.
Open source URL - [8]TA455
(Citation: Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025)
- [9]UNC1549
(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: Mandiant_UNC1549_Feb2024)
- [10]mitre-attackG1059Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.