G1059 · ATT&CK 20.0 group
NIMBUS MANTICORE
Aliases: COBALT SMOKEY, NIMBUS MANTICORE, TA455, UNC1549
[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also leveraged compromised organizations as pivot points to access other organizations of interest. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)
Aliases: COBALT SMOKEY, NIMBUS MANTICORE, TA455, UNC1549
ATT&CK techniques
T1003.006T1007T1021.001T1021.002T1027T1027.015T1036.004T1036.005T1039T1046T1047T1049T1053.005T1057T1059.001T1059.007T1070.004T1070.007T1071T1072T1078.002T1078.003T1078.004T1087.001T1087.002T1098T1105T1106T1110.003T1114.001T1136.001T1199T1204.001T1204.002T1213T1213.002T1213.005T1534T1547.001T1552T1558.003T1563.002T1566.001T1566.002T1574.001T1574.014T1583.001T1583.003T1583.006T1585.001T1587.001T1588.002T1588.003T1588.007T1591T1598.001T1608.001T1608.005T1608.006T1649T1678T1683.001T1683.002T1684.001T1685.003
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1003.006 DCSync simulation — Exact active technique ID
- T1003.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1007 System Service Discovery simulation — Exact active technique ID
- T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.015 Compression simulation — Exact active technique ID
- T1027.015 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1039 Data from Network Shared Drive simulation — Exact active technique ID
- T1039 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.007 Clear Network Connection History and Configurations simulation — Exact active technique ID
- T1070.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071 Application Layer Protocol simulation — Exact active technique ID
- T1071 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1072 Software Deployment Tools simulation — Exact active technique ID
- T1072 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.001 Local Account simulation — Exact active technique ID
- T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098 Account Manipulation simulation — Exact active technique ID
- T1098 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.003 Password Spraying simulation — Exact active technique ID
- T1110.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.001 Local Email Collection simulation — Exact active technique ID
- T1114.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.001 Local Account simulation — Exact active technique ID
- T1136.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213 Data from Information Repositories simulation — Exact active technique ID
- T1213 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.002 Sharepoint simulation — Exact active technique ID
- T1213.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.005 Messaging Applications simulation — Exact active technique ID
- T1213.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1534 Internal Spearphishing simulation — Exact active technique ID
- T1534 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552 Unsecured Credentials simulation — Exact active technique ID
- T1552 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1558.003 Kerberoasting simulation — Exact active technique ID
- T1558.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1563.002 RDP Hijacking simulation — Exact active technique ID
- T1563.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.014 AppDomainManager simulation — Exact active technique ID
- T1574.014 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.003 Code Signing Certificates simulation — Exact active technique ID
- T1588.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.007 Artificial Intelligence simulation — Exact active technique ID
- T1588.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591 Gather Victim Org Information simulation — Exact active technique ID
- T1591 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.001 Spearphishing Service simulation — Exact active technique ID
- T1598.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.001 Upload Malware simulation — Exact active technique ID
- T1608.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.005 Link Target simulation — Exact active technique ID
- T1608.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.006 SEO Poisoning simulation — Exact active technique ID
- T1608.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1649 Steal or Forge Authentication Certificates simulation — Exact active technique ID
- T1649 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1678 Delay Execution simulation — Exact active technique ID
- T1678 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.001 Written Content simulation — Exact active technique ID
- T1683.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.002 Audio-Visual Content simulation — Exact active technique ID
- T1683.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.003 Modify or Spoof Tool UI simulation — Exact active technique ID
- T1685.003 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-name
Blue Team & Defensive Security · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-name