NIMBUS MANTICORE (G1059) | Threat Actor Index

65

Techniques

13

Toolsets

0

CVEs Referenced

0

KEV Entries

About NIMBUS MANTICORE

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.

View MITRE record ↗

Techniques by Tactic (65)

Reconnaissance

T1591 Gather Victim Org InformationT1598.001 Spearphishing Service

Resource Development

T1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1585.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.003 Code Signing CertificatesT1588.007 Artificial IntelligenceT1608.001 Upload MalwareT1608.005 Link TargetT1608.006 SEO PoisoningT1683.001 Written ContentT1683.002 Audio-Visual Content

Initial Access

T1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.007 JavaScriptT1072 Software Deployment ToolsT1106 Native APIT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLLT1574.014 AppDomainManager

Persistence

T1053.005 Scheduled TaskT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1136.001 Local AccountT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or InformationT1027.015 CompressionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.007 Clear Network Connection History and ConfigurationsT1078.002 Domain AccountsT1078.003 Local AccountsT1078.004 Cloud AccountsT1574.001 DLLT1574.014 AppDomainManagerT1678 Delay ExecutionT1684.001 Impersonation

Defence Impairment

T1685.003 Modify or Spoof Tool UI

Credential Access

T1003.006 DCSyncT1110.003 Password SprayingT1552 Unsecured CredentialsT1558.003 KerberoastingT1649 Steal or Forge Authentication Certificates

Discovery

T1007 System Service DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1087.001 Local AccountT1087.002 Domain Account

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1534 Internal SpearphishingT1563.002 RDP Hijacking

Collection

T1039 Data from Network Shared DriveT1114.001 Local Email CollectionT1213 Data from Information RepositoriesT1213.002 SharepointT1213.005 Messaging Applications

Command & Control

T1071 Application Layer ProtocolT1105 Ingress Tool Transfer

Toolsets (13)

🐛

CRASHPAD S9057

Malware · Windows

🐛

DCSYNCER.SLICK S9065

Malware · Windows

🐛

DEEPROOT S9063

Malware · Linux

🐛

LIGHTRAIL S9061

Malware · Windows

🐛

MiniBike S9059

Malware · Windows

🐛

MiniBrowse S9062

Malware · Windows

🐛

MiniBus S9060

Malware · Windows

🐛

MiniFast S9052

Malware · Windows

🐛

MiniJunk S9053

Malware · Windows

🐛

POLLBLEND S9066

Malware · Windows

🐛

SIGHTGRAB S9058

Malware · Windows

🐛

TRUSTTRAP S9064

Malware · Windows

🐛

TWOSTROKE S9067

Malware · Windows

References & Reports (6)

↑