Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
Detecting Nimbus Manticore and their sideloading infection chains
Threat Actors
Malware Families
Excerpt
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore , also tracked as UNC1549 and Smoke Sandstorm. The group primarily targets aerospace and defense organizations in the Middle East and Europe. Nimbus Manticore is known for targeted phishing operations and the use of custom implants. While…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(2)
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | business-joiners-exam.azurewebsiets.net | High | Score 58/100 | First seen |
| SHA256 | 620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b | High | Score 86/100 | First seen |
| SHA256 | 072744ce205bb89a36e563a86f30df5689e64eee75106b97ce708551c8194bbc | Medium | Score 51/100 | First seen |
| SHA256 | 9b63b744dc1f3a24f057a404c5622ed0ca933752a00ce05117727c7d11f05536 | High | Score 56/100 | First seen |
| URL | https://ebix.recruitment-flow.com/ | High | Score 58/100 | First seen |
| SHA256 | d1f525eb9347133b92e9558e1413558c8348c0f35a62577f60a5192ba38eb776 | High | Score 56/100 | First seen |
| SHA256 | 3628d13d2f8af7663d58dd1aa352c8f12d12233a7318ee203f01f195573a2ed2 | Medium | Score 51/100 | First seen |
| SHA256 | 06d12a4c4e3cc725dba37445cebeba41803718ccdb63d9d637355a241f651668 | High | Score 56/100 | First seen |
| SHA256 | c7ef2ec19d158301773b1590f5b5eeb362a30f725acad8f5b3a230e9f26d14be | Medium | Score 51/100 | First seen |
| SHA256 | 8e5fc0998838559ca8611e6c03fd998a17ffc2eade24715b2fc3e723c712eb8b | Medium | Score 51/100 | First seen |
| SHA256 | eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71 | Medium | Score 51/100 | First seen |
| SHA256 | dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…