What other aliases and vendor names is UNC1549 known by?

UNC1549 is tracked across the cybersecurity industry by multiple aliases, including: Nimbus Manticore.

What are the primary motivations and sponsors of UNC1549?

UNC1549 operates from Iran with primary motivation categorized as Cyber Espionage and Intelligence Gathering, sponsored or affiliated with Iran (State-sponsored).

UNC1549

ACTIVE CAMPAIGN TRACKED ▲ High Threat Iran

Primary Aliases: Nimbus Manticore

Sponsor / State Affiliation Iran (State-sponsored)

Primary Motivation Cyber Espionage and Intelligence Gathering

Active Timeline Unknown – Present

Confidence Rating 85% (Grounded)

Middle East Infrastructure Infiltration, Edge Device Vulnerability Exploitation Campaign

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government Agencies Critical Infrastructure Telecommunications Energy Sector Defense Contractors

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Exploitation of Edge Network Devices (VPNs, Firewalls)

↗

T1566 Spearphishing via Social Engineering

↗

Execution 2

T1059 Living-off-the-Land (LotL) techniques

↗

T1059 Lateral Movement via PowerShell and WMI

↗

Credential Access & Discovery 1

T1003 Credential Harvesting

↗

Command & Control 1

T1071 Custom Malware Deployment (Backdoors)

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Nimbus Manticore Espionage Toolset Expansion: TWOSTROKE-Variant and Reverse SSH Tunneling

Strategies and Tactics 2026-08-28

Copied to clipboard

LINK COPIED TO CLIPBOARD

UNC1549

⚔️ Weaponized CVE Matrix (0)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE