Actors Insights|Latest update04/07/2026

Scarred Manticore Cluster

Suspected state sponsor: Islamic Republic of Iran

Scarred Manticore is an Iranian MOIS-linked threat cluster active since at least 2019, exposed jointly by Check Point Research and Sygnia in October 2023. The group is characterized by the use of a sophisticated passive backdoor framework targeting Windows IIS servers — a technically distinctive capability that sets it apart from most other Iranian actors. Scarred Manticore's operations focus on high-value government, military, telecommunications, and financial targets across the Middle East.

 

Targets and Goals

Scarred Manticore has targeted organizations in Israel, Saudi Arabia, Jordan, Kuwait, Oman, Iraq, and Egypt, with a focus on government ministries, military bodies, telecommunications companies, and financial institutions. The group's targeting profile and assessed MOIS affiliation suggest a strategic intelligence collection mission focused on Middle Eastern geopolitics and regional government communications.

 

Tooling and Tactics

The group's most distinctive capability is LIONTAIL — a passive implant framework that hijacks Windows HTTP.sys driver request handling to monitor and respond to specially crafted HTTP requests without binding to a standard network port, making it highly evasive against traditional network-based detection. In addition to LIONTAIL, the group uses a range of web shells, custom droppers, and memory-resident implants. Initial access is typically gained by exploiting vulnerabilities in internet-facing servers. Check Point and Sygnia noted that Scarred Manticore's technical sophistication exceeds most other Iranian threat actors they have tracked.

 

Aliases

Scarred Manticore is tracked as UNC1860 by Mandiant — which published a detailed 2024 report documenting the group's role as an initial access provider for other Iranian state actors, including those linked to destructive operations. Microsoft tracks the cluster as Storm-0861 and previously as DEV-0861.

Most Common Tactics

Targeted Regions

Albania
AL
Albania
Albania
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Iraq
IQ
Iraq
Iraq
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Israel
IL
Israel
Israel
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jordan
JO
Jordan
Jordan
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Kuwait
KW
Kuwait
Kuwait
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Middle East
ME
Middle East
Middle East
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Oman
OM
Oman
Oman
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Qatar
QA
Qatar
Qatar
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jun 2020 ~ Oct 2023
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
Jan 2019 ~ Sep 2024
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jun 2020 ~ Oct 2023
Jan 2019Sep 2026

Recent Activities

  1. Public
    UNC1860 Targets Middle Eastern Networks with Specialized Tooling

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.