Back Oodaloop

Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict

Oodaloop • May 25, 2026

During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus threat actors advancing Iran’s strategic objectives through cyber operations. These activities included targeting internet-connected cameras, conducting destructive attacks against US and Israeli entities, and exfiltrating data from cloud environments to support broader kinetic and intelligence-gathering efforts. Nimbus Manticore (also tracked as UNC1549) is an IRGC-affiliated threat actor who primarily targets the defense, aviation and telecommunication sectors through career-themed phishing campaigns. Nimbus Manticore stands out compared to other Iranian-linked groups due to its complex malware toolset. In 2025, we documented the MiniJunk malware framework used by Nimbus Manticore to target high-profile organizations across Western Europe and the Middle East. In the recent campaign, the actor adopted several new techniques, including AppDomain (application domain) hijacking, AI-assisted malware development, and SEO poisoning.

Full report : How Iranian threat actor Nimbus Manticore used techniques like AI-assisted malware development and SEO poisoning to target companies during the US-Iran war.

Informing your decisions with actionable intelligence

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian Hackers Target US Aviation with New Malware and SEO Poisoning Iranian state-aligned hackers, known as Nimbus Manticore (UNC1549), have intensified cyberattacks against the US aviation sector amid the ongoing US-Iran military conflict. Utilizing career-themed phishing and a novel method of SEO poisoning, the group has successfully deployed a new backdoor named MiniFast, which replaces the previously used MiniJunk framework. The campaign, which began in February 2026, coincided with Operation Epic Fury, and involved impersonating legitimate software providers to distribute malicious downloads. Attack vectors included fake Zoom installers and AppDomain hijacking techniques. The group’s operations have been characterized by AI-assisted malware development, allowing for rapid adaptation and deployment of new tools. The attacks have targeted organizations across the US, Europe, and the Middle East, raising concerns about the security of critical infrastructure in the aviation sector. Check Point Research has documented multiple waves of activity, with the most significant changes occurring in April 2026. 6 sources 78

Extracted Entities

Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Campaigns (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)