{
  "id": "nimbus-manticore",
  "name": "NIMBUS MANTICORE",
  "aliases": [
    "UNC1549",
    "TA455",
    "COBALT SMOKEY"
  ],
  "domain": "cyber",
  "country": "IRN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Islamic Revolutionary Guard Corps (IRGC)",
      "src": [
        "mitre-g1059"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2021,
      "src": [
        "mitre-g1059"
      ],
      "conf": "medium",
      "note": "At least 2021"
    },
    {
      "k": "attack_id",
      "v": "G1059",
      "src": [
        "mitre-g1059"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.",
      "src": [
        "mitre-g1059"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 65,
      "src": [
        "mitre-g1059"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "CRASHPAD, DCSYNCER.SLICK, DEEPROOT, LIGHTRAIL, MiniBike, MiniBrowse, MiniBus, MiniFast, MiniJunk, POLLBLEND, SIGHTGRAB, TRUSTTRAP, TWOSTROKE",
      "src": [
        "mitre-g1059"
      ],
      "conf": "high",
      "note": "13 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1059)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/nimbus-manticore.html",
  "sources": {
    "mitre-g1059": {
      "title": "NIMBUS MANTICORE, Group G1059",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1059/",
      "published": "2026-10-05",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}