NIMBUS MANTICORE
[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS…
Tag: Nimbus Manticore
Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
Cybersecurity researchers have uncovered new infrastructure and previously undocumented malware linked to Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the…
NightLedger: New Windows Backdoor by Nimbus Manticore
NightLedger is a Windows backdoor used by Nimbus Manticore, as detailed in a Kaspersky report. It is used to maintain persistent access…
BridgeHead: Custom WebSocket Tunneler by Nimbus Manticore
BridgeHead is a custom WebSocket tunneler used by Nimbus Manticore to maintain persistent access to compromised systems. It is part of the…
ArcBridge: Custom WebSocket Tunneler by Nimbus Manticore
ArcBridge is another custom WebSocket tunneler used by Nimbus Manticore. It facilitates secure communications between compromised hosts and C2 infrastructure, helping the…
MiniFast: Tunneling Tool (aka MiniUpdate, Retrograde)
MiniFast, also known as MiniUpdate and Retrograde, is a tunneling tool with functional overlaps to BridgeHead, used by Nimbus Manticore.
LIGHTRAIL: Tunneling Utility Used by Nimbus Manticore
LIGHTRAIL is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
POLLBLEND: Tunneling Utility Used by Nimbus Manticore
POLLBLEND is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
Nimbus Manticore Deploys NightLedger Backdoor and WebSocket Tunnelers in Multi-Region Espionage Campaign
Iranian state-backed hacking group Nimbus Manticore (also known as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been linked to…
Nimbus Manticore: Iranian APT Group Expanding Cyber Espionage Operations
Nimbus Manticore, also known as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549, is an Iranian state-sponsored hacking group…