An Iranian APT group aligned with the IRGC, known for intelligence-driven spear-phishing operations.
Analyst brief
Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, focused on espionage. The group primarily targets government, military, and academic sectors, with notable aggression towards Israeli individuals. Their key TTPs include spear-phishing campaigns, custom backdoors like POWERLESS, SPA-based phishing kits for credential harvesting, and ISO image infection chains. Defenders should pay close attention to spear-phishing emails impersonating credible figures, suspicious ISO file attachments, and rapid domain registration patterns used in their operations.
Educated Manticore
unknown
Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targeting government, military, and academic sectors. The group employs spear-phishing tactics, utilizing custom backdoors like POWERLESS and phishing kits designed as SPAs to harvest credentials. Their operations have included impersonating credible figures to lure victims and using ISO images to initiate infection chains. Educated Manticore's activities are characterized by rapid domain setup and aggressive spear-phishing campaigns, particularly against Israeli individuals.