Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Fake Recruitment Website Linked to Nimbus Manticore Malware Campaign
Threat Actors
Excerpt
A sophisticated malware campaign by the Iran-nexus APT group Nimbus Manticore , also tracked as UNC1549. The threat group actively targets defense and aerospace organizations using highly tailored phishing lures. Attackers deploy custom data-exfiltration implants by abusing legitimate cloud infrastructure and manipulating trusted applications to evade detection. Attackers initiate contact via LinkedIn by impersonating professional headhunters. They offer lucrative…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Attack Flow9 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b | High | Score 86/100 | First seen |
| SHA256 | 9b63b744dc1f3a24f057a404c5622ed0ca933752a00ce05117727c7d11f05536 | High | Score 56/100 | First seen |
| SHA256 | d1f525eb9347133b92e9558e1413558c8348c0f35a62577f60a5192ba38eb776 | High | Score 56/100 | First seen |
| SHA256 | 06d12a4c4e3cc725dba37445cebeba41803718ccdb63d9d637355a241f651668 | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…