File · UNC1549 · Nation-state · assessed origin Iran · refreshed 2026-10-18
attack rose · 65 techniques across 12 tactics
Analyst brief
UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential harvesting for initial access, deploying custom malware like MINIBIKE and MINIBUS backdoors. They have also been observed using evasion techniques and a tunneler named LIGHTRAIL in their operations.
Observed targets (as stated by the sources)
2 countries · 0 sectorsassessed origin · Iranobserved targets · 2
countries · 2
- United States
- Australia
as stated by the cited sources, not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique65 techniques · 12 of 15 tactics
Reconnaissance
2 techniquesResource development
13 techniquesInitial access
3 techniquesExecution
8 techniquesPersistence
3 techniquesStealth
13 techniquesDefense impairment
1 techniqueCredential access
5 techniquesDiscovery
6 techniquesLateral movement
4 techniquesCollection
5 techniquesCommand and control
2 techniques
select a technique
Arsenal
13 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Detections
6 rules · Sigma · QRadar · CortexGenerated by skopnix from this finding, each with false-positive notes. Open the list →
Take it with you
keyless · no signupReferences
11 sources- 1.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israe…
- 2.research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-eu…
- 3.blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands…
- 4.attack.mitre.org/groups/G1059
- 5.research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-eu…
- 6.research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-duri…
- 7.cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-tt…
- 8.cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1…
- 9.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-irania…
- 10.sophos.com/en-us/threat-profiles/cobalt-smokey
- +1 more in the JSON record
Track UNC1549 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.