Nimbus Manticore APT Abuses Fake Recruitment Portal to Deliver Custom Malware

Cybersecuritynews •Tushar Subhra Dutta • June 2, 2026

A state-linked hacking group has been caught running a carefully crafted fake recruitment operation to push custom malware onto unsuspecting victims. The group, known as Nimbus Manticore and also tracked as UNC1549 and Smoke Sandstorm, has a long history of targeting professionals in the aerospace and defense sectors across the Middle East and Europe. Their […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nimbus Manticore APT Targets Aerospace Sector with Fake Job Schemes The Iranian-aligned threat group Nimbus Manticore has launched a cyber campaign targeting aerospace and defense organizations. This operation utilizes a fake recruitment portal to distribute custom malware via a sophisticated sideloading technique. The group, also known as UNC1549 and Smoke Sandstorm, has a history of targeting professionals in the aerospace and defense sectors, particularly across the Middle East and Europe. The attack leverages social engineering tactics to deceive victims into executing malware. Specific details about the malware's capabilities and the exact number of affected organizations have not been disclosed. The campaign is ongoing, and organizations in the targeted sectors are advised to remain vigilant against such deceptive tactics. 2 sources 73

Extracted Entities

Nimbus Manticore APT Abuses Fake Recruitment Portal to Deliver Custom Malware

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Industries (2)