What tactics and techniques does NIMBUS MANTICORE use?

How NIMBUS MANTICORE Gets Initial Access

nimbus manticore’s tradecraft starts with access paths that blend social engineering and credential abuse. Spearphishing is used to create the first foothold, then stolen credentials and cloud account compromise let the actor move from a single user inbox or login to broader cloud access. That makes the campaign less about noisy exploitation and more about abusing legitimate trust.

The important pattern is that the group does not need to remain “exploit-heavy” after initial entry. Once valid credentials or an authenticated session are available, the attacker can operate through normal cloud workflows, which makes the activity harder to distinguish from routine administration unless identity, mail, and API telemetry are reviewed together.

For defenders, the first question is whether the compromise path begins with a phish, a reused password, a token theft event, or a weakly protected cloud account. Those entry points lead to different containment decisions, especially when mailbox rules, sign-in anomalies, or OAuth-style application access are involved.

How Valid Credentials and Cloud Features Are Abused

After access, the group tends to rely on legitimate cloud features rather than custom malware-heavy persistence. That usually means operating through normal authentication flows, cloud applications, and account permissions to collect data and maintain access without drawing attention from perimeter controls. The technique is effective because the activity looks like permitted use unless the environment is tuned to spot unusual behavior.

This is where cloud abuse becomes operationally important. A valid login is not the same thing as a trustworthy session, and a legitimate API call is not the same thing as benign activity. If an attacker is using ordinary features to reach sensitive information, detection has to focus on unusual identity behavior, unexpected mail forwarding, access to high-value applications, and access patterns that do not fit the user or service account’s normal role.

That is why responders should treat cloud-native abuse as a trust problem, not just an malware problem. The same tools that support collaboration and automation can also be used to quietly browse data, create persistence, or stage collection at low visibility.

What the Data Collection Phase Usually Looks Like

The end goal is targeted data collection, not broad destruction. In practice that often means the actor follows the access path that yields the highest-value information with the least disruption, such as mailboxes, document repositories, shared drives, identity-linked applications, or internal workflow systems. The collection phase is often incremental, because small queries and selective downloads are less likely to trigger alarms than a sudden bulk exfiltration event.

Because the actor is working inside authenticated cloud services, defenders should look at the relationship between identity and data access, not just at volume. A low-volume session can still be dangerous if it touches the wrong tenant, mailbox, or application. Unusual access to cloud applications, abnormal API activity, and mailbox forwarding changes are often more revealing than raw download counts.

In other words, the technique chain is usually: phish or steal credentials, authenticate successfully, blend into normal cloud usage, and then collect only what is needed. That makes containment dependent on knowing which identities should not be able to reach certain data, and which sessions should never be allowed to continue once suspicious behavior appears.

Risk and Threat Considerations

NIMBUS MANTICORE’s use of valid credentials and legitimate cloud features increases the chance that compromise will be missed until sensitive data has already been accessed. The main risk is not just initial intrusion, but trusted access being repurposed for collection, forwarding, or lateral cloud abuse while appearing normal in logs.

Failure mechanism: The attacker abuses a legitimate identity path, so access controls may see an authenticated user rather than an adversary. If MFA, mail protections, conditional access, and identity anomaly detection are weak or inconsistently enforced, the activity can persist long enough to reach valuable data.

Impact: Sensitive information can be exposed through mailbox rules, cloud application access, or API-driven collection, with investigation delayed because the activity resembles ordinary user or admin behavior. Response becomes harder when the access path is already trusted.

Practitioner Guidance

What to verify: Check whether the observed activity matches the user or service account’s normal cloud behavior, especially sign-in geography, device posture, application usage, and API call patterns. If the account can reach sensitive systems without strong step-up controls, treat that as a containment issue, not just a monitoring gap.

Decision rule: If you see forwarding-rule changes, suspicious OAuth consent, or unusual access to cloud applications, prioritise identity containment and session invalidation before spending time on deep forensic attribution. In this tradecraft, the fastest win is often to stop the trusted session that is being abused.

Practitioner takeaway: The key analytic mistake is assuming “valid login” means “low risk”; in campaigns like this, the decisive question is whether the authenticated identity is behaving like the owner of the account or like an intruder using the account’s trust.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques does VOID MANTICORE use?
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?