What other aliases and vendor names is UNC1549 known by?

UNC1549 is tracked across the cybersecurity industry by multiple aliases, including: Nimbus Manticore.

What are the primary motivations and sponsors of UNC1549?

UNC1549 operates from Iran with primary motivation categorized as Cyber Espionage and Intelligence Gathering, sponsored or affiliated with Iran (State-sponsored).

UNC1549

ACTIVE CAMPAIGN TRACKED ▲ High Threat Iran

Primary Aliases: Nimbus Manticore

Sponsor / State Affiliation Iran (State-sponsored)

Primary Motivation Cyber Espionage and Intelligence Gathering

Confidence Rating 85% (Grounded)

Regional Intelligence Gathering Operations

🎯 Target Sectors & Focus

Government Defense Critical Infrastructure Telecommunications Diplomatic Entities Middle Eastern Regional Organizations

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Spear-phishing with malicious attachments

↗

T1566 Exploitation of public-facing edge devices (VPNs/Firewalls)

↗

Execution 1

T1059 Living-off-the-land (LotL) techniques

↗

Credential Access & Discovery 1

T1003 Credential harvesting

↗

Command & Control 2

T1071 Custom malware/backdoor deployment

↗

T1071 Command and Control (C2) via legitimate cloud services

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Nimbus Manticore Espionage Toolset Expansion: TWOSTROKE-Variant and Reverse SSH Tunneling

Strategies and Tactics 2026-08-28

Copied to clipboard

LINK COPIED TO CLIPBOARD

UNC1549

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE