UNC1549Threat actor
- Nimbus Manticore
UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential harvesting for initial access, deploying custom malware like MINIBIKE and MINIBUS backdoors.From MISP Galaxy
Last reported 5 days ago, by SecurityWeek6 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1036Masquerading
“We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1684Social Engineering
“The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.”
- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1047Windows Management Instrumentation
“Windows Management Instrumentation (WMI)”
- T1059Command and Scripting Interpreter
“ICS now also includes the Command and Scripting Interpreter Technique, with sub-techniques for six interpreters, replacing the deprecated Command-Line Interface and Scripting techniques.”
- T1071.005Publish/Subscribe Protocols
“Two other new sub-techniques cover command and control traffic hidden in DNS and publish/subscribe protocols.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks“On the threat actor front, MITRE added Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defense, and telecoms organizations, along with its tools.”
-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“As detailed in a recent Unit 42 report, the Screening Serpens (aka UNC1549, Smoke Sandstorm, Iranian Dream Job) group targets technology, aerospace and defense professionals in the Middle East using highly tailored social engineering lures.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“The APT is also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore.”
-
31st August – Threat Intelligence Report“Researchers unveiled an expanded toolset used by the Iran-linked Nimbus Manticore threat group to target organizations in the Middle East and Europe.”
-
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel“Group-IB said the behavior aligned with techniques previously documented by Google Threat Intelligence Group (GTIG) for UNC1549.”
-
Tortoiseshell: New Toolset and Operational Infrastructure Exposed“Group-IB tracks this group as Tortoiseshell (also known as Mirage Kitten, UNC1549, and Nimbus Manticore), an Iranian-nexus threat actor affiliated with IRGC.”
Indicators in its reports
named in the reports above- locat[.]sbsin 2 reports
- tiktok-u[.]sbsin 2 reports
- 172.86.98[.]113in 1 report
- 07dd28b748656e9e1a870c538d6df68cin 1 report
- e39bb97415978fa3…20662a51f3abin 1 report
- d23c1b7b917f53e4…cf4a2b0bef4bin 1 report
- db58adc4a6c192520ed509b20a928279in 1 report
- c0dba95939f7fc1a…204f073a981din 1 report
- 597c40e0b23f38f3…3c8f200aa437in 1 report
- neexportfolio[.]comin 1 report
- neexportfolio.azurewebsites[.]netin 1 report
- aecert[.]orgin 1 report
- 185.253.116[.]81in 1 report
- 89.44.80[.]168in 1 report
- 89.44.80[.]234in 1 report
- 185.253.116[.]99in 1 report
- 95.174.68[.]199in 1 report
- 89.44.80[.]6in 1 report
- 185.253.116[.]166in 1 report
- 89.44.80[.]42in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.