UNC1549

Also known as Nimbus Manticore, TA455, COBALT SMOKEY

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential harvesting for initial access, deploying custom malware like MINIBIKE and MINIBUS backdoors. They have also been observed using evasion techniques and a tunneler named LIGHTRAIL in their operations.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.006 DCSync T1007 System Service Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1027 Obfuscated Files or Information T1027.015 Compression T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1039 Data from Network Shared Drive T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1057 Process Discovery T1059.001 PowerShell T1059.007 JavaScript T1070.004 File Deletion T1070.007 Clear Network Connection History and Configurations T1071 Application Layer Protocol T1072 Software Deployment Tools T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1087.001 Local Account T1087.002 Domain Account T1098 Account Manipulation T1105 Ingress Tool Transfer T1106 Native API T1110.003 Password Spraying T1114.001 Local Email Collection T1136.001 Local Account T1199 Trusted Relationship T1204.001 Malicious Link T1204.002 Malicious File T1213 Data from Information Repositories T1213.002 Sharepoint T1213.005 Messaging Applications T1534 Internal Spearphishing T1547.001 Registry Run Keys / Startup Folder T1552 Unsecured Credentials T1558.003 Kerberoasting T1563.002 RDP Hijacking T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1574.001 DLL T1574.014 AppDomainManager T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1585.001 Social Media Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.007 Artificial Intelligence T1591 Gather Victim Org Information T1598.001 Spearphishing Service T1608.001 Upload Malware T1608.005 Link Target T1608.006 SEO Poisoning T1649 Steal or Forge Authentication Certificates T1678 Delay Execution T1683.001 Written Content T1683.002 Audio-Visual Content T1684.001 Impersonation T1685.003 Modify or Spoof Tool UI

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.