Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware

Gbhackers •Mayura Kathir • June 2, 2026

A newly observed cyber campaign linked to the Iran-aligned threat group Nimbus Manticore (also tracked as UNC1549 and Smoke Sandstorm) is targeting aerospace and defense organizations using a deceptive recruitment workflow that delivers custom malware through a sophisticated sideloading chain. The operation highlights the group’s continued reliance on social engineering combined with stealthy execution techniques […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nimbus Manticore APT Targets Aerospace Sector with Fake Job Schemes The Iranian-aligned threat group Nimbus Manticore has launched a cyber campaign targeting aerospace and defense organizations. This operation utilizes a fake recruitment portal to distribute custom malware via a sophisticated sideloading technique. The group, also known as UNC1549 and Smoke Sandstorm, has a history of targeting professionals in the aerospace and defense sectors, particularly across the Middle East and Europe. The attack leverages social engineering tactics to deceive victims into executing malware. Specific details about the malware's capabilities and the exact number of affected organizations have not been disclosed. The campaign is ongoing, and organizations in the targeted sectors are advised to remain vigilant against such deceptive tactics. 2 sources 73

Extracted Entities

Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Countries (1)

Industries (2)

MITRE ATT&CK (1)