Actors Insights|Latest update04/07/2026

Nimbus Manticore

Named by Check PointSuspected state sponsor: Islamic Republic of Iran

Nimbus Manticore is Check Point Research's designation for a mature Iran-nexus APT group also tracked as UNC1549 (Mandiant) and Smoke Sandstorm (Microsoft), with assessed links to the IRGC. Active since at least 2022, the group conducts targeted spear phishing campaigns that impersonate HR recruiters from companies such as Boeing, Airbus, and Rheinmetall, directing victims to fake career portals that deliver the Minibike/SlugResin backdoor family. In 2025, the group significantly expanded operations into Western Europe — targeting Denmark, Sweden, and Portugal — alongside its traditional Middle East focus on Israel and the UAE, in sectors including defense, aerospace, telecommunications, and satellite providers. The group's toolset evolved to include MiniJunk, a heavily obfuscated Minibike derivative using DLL sideloading via undocumented NT APIs, and MiniBrowse, a credential stealer targeting Chrome and Edge. Command and control infrastructure is hosted on Azure App Service behind Cloudflare, providing resilience and traffic blending. A related cluster, Subtle Snail, shares code similarities but is tracked separately.

First Seen:Jan 2025
Last Seen:May 2026
Indexed Reports:2
Public IOCs:223
Cluster: UnclassifiedMisp: UNC1549
also known as:
Nimbus ManticoreUNC1549 (Mandiant)

Targeted Regions

Australia
AU
Australia
Australia
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Azerbaijan
AZ
Azerbaijan
Azerbaijan
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Denmark
DK
Denmark
Denmark
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Egypt
EG
Egypt
Egypt
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Europe
EU
Europe
Europe
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Israel
IL
Israel
Israel
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Sep 2025 ~ May 2026
Jan 2025 ~ Nov 2025
Sep 2025 ~ May 2026
Jan 2025 ~ Nov 2025
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Middle East
ME
Middle East
Middle East
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Pakistan
PK
Pakistan
Pakistan
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Portugal
PT
Portugal
Portugal
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sweden
SE
Sweden
Sweden
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
Jan 2025 ~ Nov 2025
United States
US
United States
United States
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Sep 2025 ~ May 2026
Jan 2025Dec 2026

Targeted Sectors

AerospaceInformation TechnologyDefenseTelecommunication

Recent Indexed Reports

  1. Public
    Nimbus Manticore's Operation Epic Fury: AI-Assisted Malware and SEO Poisoning
  2. Public
    Nimbus Manticore Expands Cyber-Espionage Campaigns Across Europe

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.