NIMBUS MANTICORE
IntrusionSet · ATTACK:enterprise:G1059
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1059",
"title": "NIMBUS MANTICORE",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1059",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--318cf2c8-160b-4de7-be51-ecc3ded2705f",
"external_id": "G1059",
"domain": "enterprise",
"created": "2026-10-01T14:35:26.754Z",
"modified": "2026-10-05T14:45:56.927Z",
"version": "1.0",
"aliases": [
"NIMBUS MANTICORE",
"UNC1549",
"TA455",
"COBALT SMOKEY"
],
"tactics": [
],
"source_references": [
{
"source_name": "UNC1549"
},
{
"source_name": "TA455"
},
{
"source_name": "COBALT SMOKEY"
},
{
"source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
"url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
},
{
"source_name": "CheckPoint_NimbusManticore_May2026",
"url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
},
{
"source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
},
{
"source_name": "Mandiant_UNC1549_Feb2024",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
},
{
"source_name": "Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025",
"url": "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution"
},
{
"source_name": "Sophos Iran Cobalt Smokey Nimbus Manticore October 2026",
"url": "https://www.sophos.com/en-us/threat-profiles/cobalt-smokey"
}
]
}Explicit source assertions (78)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--038059c4-ff9c-4d4e-982e-632e1f27d254
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b6d7542-bf54-4a14-a1e8-55a39c99ce02
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13bcc487-1088-4f58-8d06-025a1c0522ed
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1685.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13db5e06-ca37-4cdc-81a0-972ede455234
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1199
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cfd8afe-772b-45ee-9c3d-58188b709bf4
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1598.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1df1d28c-9de3-4d1b-8c86-ac50175a1e69
Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1070.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--232bde84-f259-4159-bc53-cee3c18b6304
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24967b0e-9ab4-4589-92fe-3179d6821dc3
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24a8acc7-3c91-44d9-a521-d1380eda581f
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d39b438-6af9-4b7e-a086-277241642c9e
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e451e48-c991-440d-b83c-320f709ceebd
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1649
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed9bf1f-0fd9-4e11-b510-dbf3f7312385
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34c63b13-dfd5-4b44-9c74-37068cbe46da
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34f9ecb9-69ac-46a1-9d02-6d5bb0d746b9
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9060
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c566ad3-26e5-45e6-bf2d-20700ca9528c
Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f715d2b-8353-408f-9e2b-d68bbd8b50f0
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47959896-6190-43f5-b449-55c67883b389
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1683.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d750754-c9cf-4e1f-a21e-9ed72765151b
CheckPoint_NimbusManticoreEurope_Sept2025 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fd0e9f0-cf27-48fe-a868-00b4291b025a
Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--570b767f-bf48-4902-aae8-9510dcad5bfc
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b675a26-550f-44a0-a15d-908bdc8703ff
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9065
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6091f1e4-505c-49ec-8cc6-67c13a5158ee
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9064
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61caf69c-7351-44fa-a78b-66f9157dc03a
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1608.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62897272-eba9-469f-ba59-df9b1e30eeb9
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63cb5def-6905-45b0-9f14-9958eb39758e
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--643bfb16-2424-4ea6-b571-bac78c913c9a
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69c7ab28-add7-49e4-8353-f604892f1481
CheckPoint_NimbusManticoreEurope_Sept2025 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ef76744-096e-495e-b96a-1fdb5d6e9108
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fe65298-7e59-4d1d-851a-d6cb38e78795
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73bfb1c8-48cf-48c9-9c3c-302722ad2388
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1003.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77ab6256-2c34-4cf6-98c4-7c2be21257e6
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78a5ebb3-2506-492e-8b50-83199b2510f1
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d1c2ebb-bddb-4312-90ca-1449e8509584
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9067
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80f16421-105e-4968-8d2d-8774919d783d
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1608.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8548408f-2e6d-401e-a38f-fbc119a97721
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--864785e4-0495-42a0-8ac6-5f1e71928b65
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--870681c3-60b5-4c91-ab00-4c9bc7cd302f
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9052
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8995c8d8-0dac-4287-ae8a-53ba6301bbb3
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9053
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a6e062c-d656-43bb-8ed1-749eeb1065e8
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c4e1965-b744-4d2e-b809-951d2b954098
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1574.014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93d3cd4c-eed4-407e-b5b0-cdc83331f3a4
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1588.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--962bca25-bd4b-4b03-8614-47df7d268192
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97035de2-88de-4d7c-a8d2-655c5247e061
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1588.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ade742b-341b-4304-995c-f8d59f33ce25
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a386e2aa-b5bf-435f-8d5a-2ad0b9a9da22
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4e398b7-f518-467c-ae1b-4ea973afb11b
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5a1488d-2028-4132-9aef-2e6da56ffca0
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af3b443b-36e3-4b72-ad8a-1b84f214b282
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b476cf81-9f9c-40bf-ac58-aa0df0af3b4e
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9061
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b59c7496-322d-41a7-b8a3-306e5b63d0f2
Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3e633f5-857d-45a9-86f1-8c71ac484cc7
CheckPoint_NimbusManticoreEurope_Sept2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3f90e75-7642-4349-a163-881389bff063
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9062
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c49d3863-1cf6-4b85-afc6-3afd974157b8
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8918b3d-8f45-4b43-b0c4-af8aa094d20f
CheckPoint_NimbusManticoreEurope_Sept2025 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8adb1db-0e1d-4f11-866b-de4dd5d31334
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c907b6a2-8ac8-479f-8ef1-73795027ff77
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c99fffdf-67c0-4ac4-85c8-d700395a2368
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb54d317-f787-4d30-a356-abf198a3923a
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf07a411-af81-4945-8c6f-511e04a978c2
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1a02e08-d9b5-41c0-9cbe-8c8e5095c3c2
Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6d7deaf-8ed1-437b-87ab-c2270015c96d
Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1683.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc4aca7c-eb01-4820-b2c7-b0016c27641b
CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2680570-7f75-40a6-89e9-37f570964e38
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9063
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e432f3de-edd7-4ff4-bc07-a23e6ce5981b
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4b04735-40ca-4479-b978-0745912b361b
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6449c83-38cd-4af9-b3d9-a5fb939c9a52
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e756554a-3da8-4dd0-a4ec-1f33bc8c4df7
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9058
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8e7d332-532c-44b3-94e6-594c4d912ae4
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e92fe381-6537-4cd1-9e30-bb8f0724498d
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec2a35a4-081b-421d-a280-f808f6b93b48
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edb23250-7787-45ba-97ad-2b2f34923f2d
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee291097-fca7-4a62-bf82-e05e6c6e49e9
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:S9066
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eec56bc8-6478-434c-b5f5-fd16bc967412
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f246be13-4b00-4739-aedb-091cf6115182
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f59a5bb3-372a-4242-928d-fa8ba2b0c710
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd99bb5e-8c96-4213-9ccd-ee21777cb9fa
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdd667be-ef2f-4def-ab36-1a64f960fb1d
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe10ef02-3c90-4b9b-93e0-b9fe6372c4d0
Mandiant_UNC1549TTPsTools_Nov2025