Nimbus Manticore (UNC1549) Threat Actor Profile: Tradecraft and Defences

Nimbus Manticore, also tracked as UNC1549, is an Iran-linked espionage group that reaches aerospace and defence organisations through fake job offers and trusted suppliers, then takes over identity infrastructure from the inside. MITRE ATT&CK added the group as G1059 in its v20 release, describing it as associated with Iran's Islamic Revolutionary Guard Corps (IRGC). Mandiant and Check Point Research have published detailed reporting on its recruitment lures, Azure-hosted command and control, and abuse of Active Directory. This profile summarises who the group is, what it targets, its ATT&CK techniques, how it abuses credentials, and what defenders in aerospace, defence, telecommunications and their supply chains should do. For the wider set of Iranian actors, see the Iran State Cyber Operations Guide and the Threat Actor Groups Guide.

Key takeaways

• Recruitment is the lure. The group impersonates recruiters and brands such as Boeing, Airbus and Rheinmetall, starting on LinkedIn and moving victims to fake career portals that hand out malicious archives.
• Suppliers are the side door. Mandiant observed stolen vendor and contractor credentials used to enter victims through Citrix, VMware and Azure Virtual Desktop sessions.
• Identity systems are the prize. Reported techniques include DCSync, Kerberoasting, abuse of vulnerable AD CS templates, resetting domain controller computer account passwords and access to Azure AD Connect accounts.
• Infrastructure hides in plain sight. Command and control runs on Azure Web Apps and cloudapp.azure.com subdomains named to look like the victim's industry, plus reverse SSH tunnels over port 443.
• Defend the hiring and supplier channels. Unsolicited job contact, third-party remote access and Tier 0 identity monitoring are where controls pay off fastest.

Who they are (names and aliases)

Attribution as stated by sources: ATT&CK describes the group as state-sponsored espionage associated with the IRGC and active since 2021. Mandiant's February 2024 report attributed UNC1549 to Iran with moderate confidence and called the IRGC link a potential one, based on its overlap with Tortoiseshell. Mandiant's November 2025 report calls it an Iranian-backed group. Use those qualifiers when briefing leadership.

Targeting and motivation

• Sectors: aerospace, aviation and defence are constant across all reporting. Check Point adds defence manufacturing, telecommunications (especially satellite providers) and airlines; ATT&CK adds information technology.
• Regions: Mandiant's 2024 report confirmed Israel and the UAE, with possible activity in Turkey, India and Albania. Check Point's September 2025 report highlighted Denmark, Sweden and Portugal as a growing Western European focus. ATT&CK also lists the United States and Australia.
• Objectives: ATT&CK records the group seeking network and IT documentation, intellectual property and email, and using compromised organisations as pivots to reach others of interest. That fits long-term espionage against the defence industrial base rather than disruption or profit.
• Supply chain: Mandiant's 2025 report describes deliberate targeting of defence contractors' third-party suppliers and partners as a route to the primary target.

Contractors should also read the Defence Industrial Base Identity Security Guide.

Tactics and techniques (MITRE ATT&CK)

The table selects the techniques ATT&CK v20 records for G1059 that matter most for detection planning.

ATT&CK lists associated software including MiniBike (S9059), MiniBus (S9060), MiniJunk (S9053), MiniBrowse (S9062), LIGHTRAIL (S9061), TWOSTROKE (S9067), DEEPROOT (S9063), POLLBLEND (S9066), CRASHPAD (S9057), SIGHTGRAB (S9058), TRUSTTRAP (S9064) and DCSYNCER.SLICK (S9065).

How they abuse identities and credentials

Nimbus Manticore is an identity-first intruder: once inside, Mandiant's reporting shows it moving quickly to the systems that issue and replicate credentials.

• Third-party accounts: compromised vendor and contractor credentials opened Citrix, VMware and Azure Virtual Desktop sessions, from which the actor broke out to the underlying host. See the Third-Party Access Guide.
• Help desk style phishing of admins: after initial access the group phished IT staff and administrators, copying the organisation's real password reset process from old emails to harvest privileged credentials.
• Domain controller machine accounts: Mandiant reports resets of domain controller computer account passwords to gain replication rights, often causing outages, plus rogue computer accounts and resource-based constrained delegation abuse. Machine accounts are non-human identities and need the same monitoring as admins.
• DCSync and Kerberoasting: DCSYNCER.SLICK pulled NTLM hashes, including for Azure AD Connect accounts; obfuscated Kerberoasting scripts targeted service accounts. See the Golden Ticket, Silver Ticket and DCSync Guide and the Kerberoasting and AS-REP Roasting Defence Guide.
• Certificates: vulnerable AD CS templates were used to request certificates impersonating higher-privilege users. See the AD CS Security Guide.
• Hybrid identity: ATT&CK records Azure AD Connect accounts used to change permissions and create accounts. See the Microsoft Entra Connect and Cloud Sync Hardening Guide.
• Browser and prompt theft: CRASHPAD and MiniBrowse extract saved browser credentials; TRUSTTRAP shows a fake Outlook login prompt.

Notable incidents

• 2022 to 2024, Middle East aerospace and defence: Mandiant's February 2024 report described campaigns against Israel and the UAE using fake recruiting sites, credential pages imitating Boeing and Teledyne FLIR portals, Israel-Hamas themed lures, and more than 125 Azure C2 subdomains.
• 2025, Western Europe expansion: Check Point reported a September 2025 wave against defence manufacturing, satellite telecommunications and airlines in Denmark, Sweden and Portugal, with per-victim login credentials on React-built fake career portals and samples signed using SSL.com certificates from May 2025.
• Late 2023 to 2025, supplier-led intrusions: Mandiant's November 2025 report covered incident response engagements from mid-2024 involving third-party access, DCSync and reverse SSH tunnels, with ZeroTier and ngrok added as fallback access after victims began remediation.

No breach page in the NHI Mgmt Group database is attributed to this group. The Storm-0501 hybrid cloud attacks show the same Entra Connect sync account risk from a different actor.

Detection and defence

Priority detections

See the Active Directory Security Monitoring and Event IDs Guide for event configuration.

Phased response plan

1. Brief the exposed staff (week 1): engineers, HR and executives in aerospace and defence roles should know that recruiters asking them to log in to a portal and run software is a known lure. See the Job and Task Scams Guide.
2. Lock down third-party paths (weeks 1 to 4): require phishing-resistant MFA on every Citrix, VMware Horizon and Azure Virtual Desktop entry point used by suppliers, restrict session breakout (clipboard, drive mapping, shell escape) and log sessions.
3. Harden Tier 0 (weeks 2 to 8): audit AD CS templates, remove RC4 where possible, rotate service account passwords to long random values or move to gMSA, and protect Entra Connect servers as Tier 0. Pilot template changes on a test CA and keep the previous template versions exported for rollback.
4. Deploy detections: start the table above in alert-only mode for two weeks to tune false positives, then route to on-call.
5. Hunt: search for historical signs of the behaviours above, Run keys and scheduled tasks pointing at user-writable paths, and contact with suspicious Azure subdomains.
6. Prepare to evict: Mandiant observed fallback tunnels appearing once remediation began, so plan a coordinated reset of krbtgt, DC machine accounts, sync accounts and privileged users in one window. See the Active Directory Domain Compromise Response Playbook.

Decision guidance

• Primes versus small suppliers: large primes should require suppliers to use a brokered access platform with MFA and recording; small suppliers with no SOC should at minimum enforce MFA, keep EDR on every host used for client access and report suspicious recruiter contact to their customer.
• Blocking Azure domains: blanket blocking of azurewebsites.net breaks legitimate services. Prefer alerting on first-seen subdomains and allowlisting the ones your business uses.
• Indicators versus behaviour: Mandiant notes each post-exploitation payload had a unique hash, so hash lists age fast; invest in behavioural detections first.

Common failure patterns

• Supplier VDI accounts protected by password only, because "it is just a remote desktop".
• DC machine account resets dismissed as a replication fault when the outage hits.
• Credentials stored in help desk tickets, which ATT&CK records the group harvesting.
• Entra Connect servers managed as ordinary member servers rather than Tier 0.
• Personal LinkedIn approaches treated as outside the security team's scope.

Metrics

• Percentage of third-party remote access accounts with phishing-resistant MFA.
• Number of AD CS templates with enrollee-supplied subject and broad enrolment rights (target: zero).
• Percentage of service accounts with passwords over 25 characters or managed by gMSA.
• Time from DCSync alert to triage.
• Number of suspicious recruiter approaches reported by staff per quarter (a rising number usually means awareness is working).

Framework mapping

Practitioner checklist

• Brief engineering, HR and leadership staff on fake recruiter and career portal lures.
• Enforce phishing-resistant MFA on all supplier VDI and remote access paths and restrict session breakout.
• Alert on DCSync from non-DC hosts and on any reset of a domain controller computer account.
• Audit AD CS templates and remove enrollee-supplied subject on privileged templates.
• Manage Entra Connect servers and sync accounts as Tier 0.
• Remove credentials from ticketing systems and scan tickets for secrets.
• Alert on ssh.exe reverse forwarding and first-seen Azure app subdomains from endpoints.
• Plan a coordinated credential reset, including krbtgt and machine accounts, before evicting.

Standards and references

• MITRE ATT&CK: NIMBUS MANTICORE (G1059)
• Google Threat Intelligence (Mandiant): Analysis of UNC1549 TTPs Targeting Aerospace and Defense
• Mandiant: Suspected Iranian UNC1549 Targets Israel and the Middle East
• Check Point Research: Nimbus Manticore Deploys New Malware Targeting Europe
• MITRE ATT&CK: OS Credential Dumping: DCSync (T1003.006)
• MITRE ATT&CK: Trusted Relationship (T1199)
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Iran State Cyber Operations Guide · Threat Actor Groups Guide · APT33 Threat Actor Profile Guide · Third-Party Access Guide