NIMBUS MANTICORE
NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has…
- ATT&CK ID
- G1059
- Techniques
- 45
- Tools
- 13
Also tracked as UNC1549 · TA455 · COBALT SMOKEY
Techniques
Reconnaissance
Gather Victim Org InformationPhishing for Information
Resource Development
Acquire InfrastructureEstablish AccountsDevelop CapabilitiesObtain CapabilitiesStage CapabilitiesGenerate Content
Initial Access
Valid AccountsTrusted RelationshipPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterSoftware Deployment ToolsNative APIUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobValid AccountsAccount ManipulationCreate AccountBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobValid AccountsAccount ManipulationBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsHijack Execution FlowDelay ExecutionSocial Engineering
Defense Impairment
Credential Access
OS Credential DumpingBrute ForceUnsecured CredentialsSteal or Forge Kerberos TicketsSteal or Forge Authentication Certificates
Discovery
System Service DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryProcess DiscoveryAccount Discovery
Lateral Movement
Remote ServicesSoftware Deployment ToolsInternal SpearphishingRemote Service Session Hijacking
Collection
Data from Network Shared DriveEmail CollectionData from Information Repositories
Command and Control
Application Layer ProtocolIngress Tool Transfer
Software
CRASHPAD · DCSYNCER.SLICK · DEEPROOT · LIGHTRAIL · MiniBike · MiniBrowse · MiniBus · MiniFast · MiniJunk · POLLBLEND · SIGHTGRAB · TRUSTTRAP · TWOSTROKE