Nimbus Manticore, also tracked as UNC1549, is an Iran-linked espionage group that reaches aerospace and defence organisations through fake job offers and trusted suppliers, then takes over identity infrastructure from the inside. MITRE ATT&CK added the group as G1059 in its v20 release, describing it as associated with Iran's Islamic Revolutionary Guard Corps (IRGC). Mandiant and Check Point Research have published detailed reporting on its recruitment lures, Azure-hosted command and control, and abuse of Active Directory. This profile summarises who the group is, what it targets, its ATT&CK techniques, how it abuses credentials, and what defenders in aerospace, defence, telecommunications and their supply chains should do. For the wider set of Iranian actors, see the Iran State Cyber Operations Guide and the Threat Actor Groups Guide.
Key takeaways
- Recruitment is the lure. The group impersonates recruiters and brands such as Boeing, Airbus and Rheinmetall, starting on LinkedIn and moving victims to fake career portals that hand out malicious archives.
- Suppliers are the side door. Mandiant observed stolen vendor and contractor credentials used to enter victims through Citrix, VMware and Azure Virtual Desktop sessions.
- Identity systems are the prize. Reported techniques include DCSync, Kerberoasting, abuse of vulnerable AD CS templates, resetting domain controller computer account passwords and access to Azure AD Connect accounts.
- Infrastructure hides in plain sight. Command and control runs on Azure Web Apps and cloudapp.azure.com subdomains named to look like the victim's industry, plus reverse SSH tunnels over port 443.
- Defend the hiring and supplier channels. Unsolicited job contact, third-party remote access and Tier 0 identity monitoring are where controls pay off fastest.
Who they are (names and aliases)
| Name | Used by | Notes |
|---|---|---|
| NIMBUS MANTICORE | Check Point Research; MITRE ATT&CK G1059 | ATT&CK primary name |
| UNC1549 | Mandiant (Google Threat Intelligence) | Uncategorised cluster name; activity observed from June 2022 |
| TA455 | Proofpoint (as listed by ATT&CK) | Alias recorded in ATT&CK |
| COBALT SMOKEY | Sophos (as listed by ATT&CK) | Alias recorded in ATT&CK |
| Smoke Sandstorm, Tortoiseshell | Overlap noted by Mandiant and Check Point | Mandiant described the overlap with Tortoiseshell at moderate confidence |
Attribution as stated by sources: ATT&CK describes the group as state-sponsored espionage associated with the IRGC and active since 2021. Mandiant's February 2024 report attributed UNC1549 to Iran with moderate confidence and called the IRGC link a potential one, based on its overlap with Tortoiseshell. Mandiant's November 2025 report calls it an Iranian-backed group. Use those qualifiers when briefing leadership.
Targeting and motivation
- Sectors: aerospace, aviation and defence are constant across all reporting. Check Point adds defence manufacturing, telecommunications (especially satellite providers) and airlines; ATT&CK adds information technology.
- Regions: Mandiant's 2024 report confirmed Israel and the UAE, with possible activity in Turkey, India and Albania. Check Point's September 2025 report highlighted Denmark, Sweden and Portugal as a growing Western European focus. ATT&CK also lists the United States and Australia.
- Objectives: ATT&CK records the group seeking network and IT documentation, intellectual property and email, and using compromised organisations as pivots to reach others of interest. That fits long-term espionage against the defence industrial base rather than disruption or profit.
- Supply chain: Mandiant's 2025 report describes deliberate targeting of defence contractors' third-party suppliers and partners as a route to the primary target.
Contractors should also read the Defence Industrial Base Identity Security Guide.
Tactics and techniques (MITRE ATT&CK)
The table selects the techniques ATT&CK v20 records for G1059 that matter most for detection planning.
| Tactic | Technique | Reported behaviour |
|---|---|---|
| Resource development | T1585.001 Social Media Accounts; T1583.003 Virtual Private Server; T1583.006 Web Services; T1588.003 Code Signing Certificates | Fake recruiter profiles; Azure-hosted C2; OnlyOffice for payload delivery; samples signed with SSL.com certificates |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1199 Trusted Relationship | Job-themed archives and links; access through third-party connections |
| Execution | T1204.002 Malicious File; T1059.001 PowerShell | Victim runs fake hiring software; PowerShell for enumeration |
| Persistence | T1574.001 DLL; T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder; T1136.001 Local Account | DLL search order hijacking and sideloading; scheduled tasks; Run keys; rogue accounts |
| Credential access | T1003.006 DCSync; T1558.003 Kerberoasting; T1649 Steal or Forge Authentication Certificates; T1110.003 Password Spraying; T1552 Unsecured Credentials | NTLM hashes via DCSync; AD CS template abuse; credentials from internal ticketing systems |
| Privilege escalation, persistence | T1098 Account Manipulation; T1078.002 Domain Accounts; T1078.004 Cloud Accounts | Password resets on domain accounts; Azure AD Connect accounts used to change permissions and create accounts |
| Lateral movement | T1021.001 Remote Desktop Protocol; T1563.002 RDP Hijacking; T1072 Software Deployment Tools; T1534 Internal Spearphishing | RDP with stolen credentials; session hijacking; remote management tools; phishing IT staff from inside |
| Collection | T1213.002 Sharepoint; T1213.005 Messaging Applications; T1039 Data from Network Shared Drive; T1114.001 Local Email Collection | SharePoint and Teams files; SMB shares; old emails mined for lures |
| Command and control | T1071 Application Layer Protocol | Reverse SSH shells; Azure Web Apps C2 |
| Defence evasion | T1070.007 Clear Network Connection History and Configurations; T1036.005 Match Legitimate Resource Name or Location | RDP history keys removed; malware named like legitimate software |
ATT&CK lists associated software including MiniBike (S9059), MiniBus (S9060), MiniJunk (S9053), MiniBrowse (S9062), LIGHTRAIL (S9061), TWOSTROKE (S9067), DEEPROOT (S9063), POLLBLEND (S9066), CRASHPAD (S9057), SIGHTGRAB (S9058), TRUSTTRAP (S9064) and DCSYNCER.SLICK (S9065).
How they abuse identities and credentials
Nimbus Manticore is an identity-first intruder: once inside, Mandiant's reporting shows it moving quickly to the systems that issue and replicate credentials.
- Third-party accounts: compromised vendor and contractor credentials opened Citrix, VMware and Azure Virtual Desktop sessions, from which the actor broke out to the underlying host. See the Third-Party Access Guide.
- Help desk style phishing of admins: after initial access the group phished IT staff and administrators, copying the organisation's real password reset process from old emails to harvest privileged credentials.
- Domain controller machine accounts: Mandiant reports resets of domain controller computer account passwords to gain replication rights, often causing outages, plus rogue computer accounts and resource-based constrained delegation abuse. Machine accounts are non-human identities and need the same monitoring as admins.
- DCSync and Kerberoasting: DCSYNCER.SLICK pulled NTLM hashes, including for Azure AD Connect accounts; obfuscated Kerberoasting scripts targeted service accounts. See the Golden Ticket, Silver Ticket and DCSync Guide and the Kerberoasting and AS-REP Roasting Defence Guide.
- Certificates: vulnerable AD CS templates were used to request certificates impersonating higher-privilege users. See the AD CS Security Guide.
- Hybrid identity: ATT&CK records Azure AD Connect accounts used to change permissions and create accounts. See the Microsoft Entra Connect and Cloud Sync Hardening Guide.
- Browser and prompt theft: CRASHPAD and MiniBrowse extract saved browser credentials; TRUSTTRAP shows a fake Outlook login prompt.
Notable incidents
- 2022 to 2024, Middle East aerospace and defence: Mandiant's February 2024 report described campaigns against Israel and the UAE using fake recruiting sites, credential pages imitating Boeing and Teledyne FLIR portals, Israel-Hamas themed lures, and more than 125 Azure C2 subdomains.
- 2025, Western Europe expansion: Check Point reported a September 2025 wave against defence manufacturing, satellite telecommunications and airlines in Denmark, Sweden and Portugal, with per-victim login credentials on React-built fake career portals and samples signed using SSL.com certificates from May 2025.
- Late 2023 to 2025, supplier-led intrusions: Mandiant's November 2025 report covered incident response engagements from mid-2024 involving third-party access, DCSync and reverse SSH tunnels, with ZeroTier and ngrok added as fallback access after victims began remediation.
No breach page in the NHI Mgmt Group database is attributed to this group. The Storm-0501 hybrid cloud attacks show the same Entra Connect sync account risk from a different actor.
Detection and defence
Priority detections
| Behaviour | Telemetry | Detection idea |
|---|---|---|
| DCSync from a non-DC host | Windows Security event 4662 with replication rights GUIDs on domain controllers | Alert when the requesting account or host is not a domain controller or approved sync account |
| Domain controller computer account password reset | Event 4724 (password reset) and 4742 (computer account changed) | Treat any manual reset of a DC machine account as a Tier 0 incident |
| Kerberoasting | Event 4769 with RC4 ticket encryption for service accounts | Volume and encryption type anomalies per requesting user |
| AD CS template abuse | CA events 4886 and 4887 | Certificates issued with a subject different from the requester on sensitive templates |
| Reverse SSH over 443 | EDR process telemetry, proxy logs | ssh.exe launched on Windows endpoints with remote forwarding to external hosts |
| Azure-hosted C2 | DNS and proxy logs | New azurewebsites.net or cloudapp.azure.com subdomains contacted by endpoints with no business reason |
| DLL sideloading | EDR image load events | Signed vendor executables loading DLLs from user-writable paths such as %LOCALAPPDATA% |
See the Active Directory Security Monitoring and Event IDs Guide for event configuration.
Phased response plan
- Brief the exposed staff (week 1): engineers, HR and executives in aerospace and defence roles should know that recruiters asking them to log in to a portal and run software is a known lure. See the Job and Task Scams Guide.
- Lock down third-party paths (weeks 1 to 4): require phishing-resistant MFA on every Citrix, VMware Horizon and Azure Virtual Desktop entry point used by suppliers, restrict session breakout (clipboard, drive mapping, shell escape) and log sessions.
- Harden Tier 0 (weeks 2 to 8): audit AD CS templates, remove RC4 where possible, rotate service account passwords to long random values or move to gMSA, and protect Entra Connect servers as Tier 0. Pilot template changes on a test CA and keep the previous template versions exported for rollback.
- Deploy detections: start the table above in alert-only mode for two weeks to tune false positives, then route to on-call.
- Hunt: search for historical signs of the behaviours above, Run keys and scheduled tasks pointing at user-writable paths, and contact with suspicious Azure subdomains.
- Prepare to evict: Mandiant observed fallback tunnels appearing once remediation began, so plan a coordinated reset of krbtgt, DC machine accounts, sync accounts and privileged users in one window. See the Active Directory Domain Compromise Response Playbook.
Decision guidance
- Primes versus small suppliers: large primes should require suppliers to use a brokered access platform with MFA and recording; small suppliers with no SOC should at minimum enforce MFA, keep EDR on every host used for client access and report suspicious recruiter contact to their customer.
- Blocking Azure domains: blanket blocking of azurewebsites.net breaks legitimate services. Prefer alerting on first-seen subdomains and allowlisting the ones your business uses.
- Indicators versus behaviour: Mandiant notes each post-exploitation payload had a unique hash, so hash lists age fast; invest in behavioural detections first.
Common failure patterns
- Supplier VDI accounts protected by password only, because "it is just a remote desktop".
- DC machine account resets dismissed as a replication fault when the outage hits.
- Credentials stored in help desk tickets, which ATT&CK records the group harvesting.
- Entra Connect servers managed as ordinary member servers rather than Tier 0.
- Personal LinkedIn approaches treated as outside the security team's scope.
Metrics
- Percentage of third-party remote access accounts with phishing-resistant MFA.
- Number of AD CS templates with enrollee-supplied subject and broad enrolment rights (target: zero).
- Percentage of service accounts with passwords over 25 characters or managed by gMSA.
- Time from DCSync alert to triage.
- Number of suspicious recruiter approaches reported by staff per quarter (a rising number usually means awareness is working).
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Supplier access | GV.SC-05 | AC-17, SR-6 |
| Authentication and credentials | PR.AA-01, PR.AA-03 | IA-2, IA-5 |
| Privilege and account management | PR.AA-05 | AC-2, AC-6 |
| Awareness | PR.AT-01 | AT-2 |
| Monitoring and analysis | DE.CM-01, DE.AE-02 | SI-4, AU-6 |
| Threat intelligence | ID.RA-02 | PM-16 |
Practitioner checklist
- Brief engineering, HR and leadership staff on fake recruiter and career portal lures.
- Enforce phishing-resistant MFA on all supplier VDI and remote access paths and restrict session breakout.
- Alert on DCSync from non-DC hosts and on any reset of a domain controller computer account.
- Audit AD CS templates and remove enrollee-supplied subject on privileged templates.
- Manage Entra Connect servers and sync accounts as Tier 0.
- Remove credentials from ticketing systems and scan tickets for secrets.
- Alert on ssh.exe reverse forwarding and first-seen Azure app subdomains from endpoints.
- Plan a coordinated credential reset, including krbtgt and machine accounts, before evicting.
Standards and references
- MITRE ATT&CK: NIMBUS MANTICORE (G1059)
- Google Threat Intelligence (Mandiant): Analysis of UNC1549 TTPs Targeting Aerospace and Defense
- Mandiant: Suspected Iranian UNC1549 Targets Israel and the Middle East
- Check Point Research: Nimbus Manticore Deploys New Malware Targeting Europe
- MITRE ATT&CK: OS Credential Dumping: DCSync (T1003.006)
- MITRE ATT&CK: Trusted Relationship (T1199)
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Iran State Cyber Operations Guide · Threat Actor Groups Guide · APT33 Threat Actor Profile Guide · Third-Party Access Guide