← Back to Actors
NIMBUS MANTICORE
NIMBUS MANTICOREUNC1549TA455COBALT SMOKEY
[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. [NIMBUS MANTICORE](https://attack.mit...
65
Techniques
50
Covered
15
Gaps
77%
Coverage
Coverage50/65
GAPS (15)
T1070.007Clear Network Connection History and ConfigurationsT1213.005Messaging ApplicationsT1583.003Virtual Private ServerT1585.001Social Media AccountsT1588.003Code Signing CertificatesT1588.007Artificial IntelligenceT1591Gather Victim Org InformationT1598.001Spearphishing ServiceT1608.005Link TargetT1608.006SEO PoisoningT1678Delay ExecutionT1683.001Written ContentT1683.002Audio-Visual ContentT1684.001ImpersonationT1685.003Modify or Spoof Tool UI
COVERED (50)
T1003.006DCSync16 det.T1007System Service Discovery15 det.T1021.001Remote Desktop Protocol55 det.T1021.002SMB/Windows Admin Shares74 det.T1027Obfuscated Files or Information707 det.T1027.015Compression2 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location49 det.T1039Data from Network Shared Drive7 det.T1046Network Service Discovery53 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.007JavaScript64 det.T1070.004File Deletion46 det.T1071Application Layer Protocol120 det.T1072Software Deployment Tools13 det.T1078.002Domain Accounts28 det.T1078.003Local Accounts24 det.T1078.004Cloud Accounts200 det.T1087.001Local Account35 det.T1087.002Domain Account58 det.T1098Account Manipulation258 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1110.003Password Spraying73 det.T1114.001Local Email Collection11 det.T1136.001Local Account46 det.T1199Trusted Relationship6 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1213Data from Information Repositories25 det.T1213.002Sharepoint4 det.T1534Internal Spearphishing300 det.T1547.001Registry Run Keys / Startup Folder53 det.T1552Unsecured Credentials118 det.T1558.003Kerberoasting35 det.T1563.002RDP Hijacking5 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1574.001DLL111 det.T1574.014AppDomainManager1 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.002Tool13 det.T1608.001Upload Malware3 det.T1649Steal or Forge Authentication Certificates27 det.