NIMBUS MANTICORE

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.¹²³⁴

1. Mandiant_UNC1549TTPsTools_Nov2025
2. CheckPoint_NimbusManticore_May2026
3. CheckPoint_NimbusManticoreEurope_Sept2025
4. Mandiant_UNC1549_Feb2024

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

Technique use

Aliases

COBALT SMOKEY · NIMBUS MANTICORE · TA455 · UNC1549

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections