Skip to content
ThreatCluster

Nimbus Manticore APT Targets Aerospace Sector with Fake Job Schemes

First seen 2 Jun 2026, 08:23 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 3, 2026 at 07:54 UTC
  • •Nimbus Manticore uses fake job offers to deliver custom malware to aerospace firms.
  • •The group is linked to Iran and has a history of targeting defense sectors in the Middle East and Europe.
  • •The attack employs sophisticated sideloading techniques and social engineering.

The Iranian-aligned threat group Nimbus Manticore has launched a cyber campaign targeting aerospace and defense organizations. This operation utilizes a fake recruitment portal to distribute custom malware via a sophisticated sideloading technique. The group, also known as UNC1549 and Smoke Sandstorm, has a history of targeting professionals in the aerospace and defense sectors, particularly across the Middle East and Europe. The attack leverages social engineering tactics to deceive victims into executing malware. Specific details about the malware's capabilities and the exact number of affected organizations have not been disclosed. The campaign is ongoing, and organizations in the targeted sectors are advised to remain vigilant against such deceptive tactics.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 135d ago How this analysis works

Timeline

2026-06-02
Nimbus Manticore cyber campaign identified
The group is using a fake recruitment portal to deliver malware to aerospace and defense organizations.
Gbhackers
2026-06-02
Fake recruitment operation reported
Nimbus Manticore's operation targets professionals in the aerospace sector, leveraging social engineering tactics.
Cybersecuritynews

More articles in this cluster (2)

Following this threat?

Track Nimbus Manticore in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3