D
CyberIran

NIMBUS MANTICORE

State-sponsored cyber threat groupTrackedPending verification

Also known as: UNC1549, TA455, COBALT SMOKEY

CyberIRN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsUNC1549, TA455, COBALT SMOKEY
ProliferationOrigin country only
Active since2021At least 2021Med[1]
MITRE ATT&CK IDG1059High[1]
Capabilities
ATT&CK techniques used65ATT&CK v20.1High[1]
Malware and toolsCRASHPAD, DCSYNCER.SLICK, DEEPROOT, LIGHTRAIL, MiniBike, MiniBrowse, MiniBus, MiniFast, MiniJunk, POLLBLEND, SIGHTGRAB, TRUSTTRAP, TWOSTROKE13 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorIslamic Revolutionary Guard Corps (IRGC)High[1]
TargetsNIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.Med[1]
Notes
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Iran
Sources
  1. NIMBUS MANTICORE, Group G1059, MITRE ATT&CK
    Published/updated 2026-10-05 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1059)